CVE-2023-35313
📋 TL;DR
This vulnerability allows remote code execution through the Windows Online Certificate Status Protocol (OCSP) SnapIn component. Attackers can exploit this to execute arbitrary code with SYSTEM privileges on affected systems. This affects Windows systems with the vulnerable OCSP SnapIn component.
💻 Affected Systems
- Windows Server
- Windows Client
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 21h2 by Microsoft
Windows 11 22h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with SYSTEM privileges, enabling complete control over the affected system, data theft, lateral movement, and persistence establishment.
Likely Case
Remote code execution leading to malware deployment, credential harvesting, or ransomware installation on vulnerable systems.
If Mitigated
Limited impact due to network segmentation, proper patch management, and restricted administrative access preventing successful exploitation.
🎯 Exploit Status
Microsoft rates this as 'Exploitation More Likely' in their advisory. The vulnerability requires specific conditions to be met for successful exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply the latest Windows security updates from Microsoft
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35313
Restart Required: Yes
Instructions:
1. Apply the latest Windows security updates from Microsoft. 2. Restart affected systems. 3. Verify the patch is applied successfully.
🔧 Temporary Workarounds
Disable OCSP SnapIn
windowsDisable the vulnerable OCSP SnapIn component if not required
Disable via Windows Features or Group Policy
Network Segmentation
allRestrict network access to systems running OCSP services
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems
- Apply principle of least privilege and restrict administrative access
🔍 How to Verify
Check if Vulnerable:
Check if OCSP SnapIn is enabled and verify Windows version against affected versions listCheck Version:
wmic os get versionVerify Fix Applied:
Verify Windows Update history shows the security patch applied and system version is updated📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from OCSP-related services
- Failed authentication attempts to OCSP services
- Abnormal network connections to OCSP ports
Network Indicators:
- Suspicious traffic to OCSP service ports
- Unusual certificate validation requests
SIEM Query:
Process creation where parent process contains 'ocsp' OR network traffic to port 80/443 with destination containing certificate validation patterns