CVE-2023-35371
📋 TL;DR
This vulnerability in Microsoft Office allows attackers to execute arbitrary code on a victim's system by tricking them into opening a specially crafted Office document. It affects users of Microsoft Office applications who open malicious files from untrusted sources.
💻 Affected Systems
- Microsoft Office
- Microsoft 365 Apps
📦 What is this software?
365 Apps by Microsoft
Office by Microsoft
Office by Microsoft
Office Long Term Servicing Channel by Microsoft
View all CVEs affecting Office Long Term Servicing Channel →
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the victim's computer, enabling data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Malware installation leading to data exfiltration, credential theft, or lateral movement within the network.
If Mitigated
Limited impact with proper application whitelisting and macro restrictions preventing malicious document execution.
🎯 Exploit Status
Requires social engineering to deliver malicious document; exploitation likely through phishing campaigns
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: July 2023 security updates
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35371
Restart Required: Yes
Instructions:
1. Open affected Office application. 2. Go to File > Account > Update Options > Update Now. 3. Restart computer after update completes.
🔧 Temporary Workarounds
Block Office documents from untrusted sources
windowsConfigure Group Policy to block Office documents from the internet or untrusted locations
Disable automatic document opening
windowsChange Office settings to prevent automatic opening of documents from email or web
🧯 If You Can't Patch
- Implement application control/whitelisting to restrict which Office documents can execute
- Deploy email filtering to block Office documents from external sources and train users on phishing awareness
🔍 How to Verify
Check if Vulnerable:
Check Office version against July 2023 security update version in File > Account > AboutCheck Version:
In Office app: File > Account > About [Application Name]Verify Fix Applied:
Verify Office build number is equal to or greater than July 2023 security update version📡 Detection & Monitoring
Log Indicators:
- Unusual Office process spawning child processes
- Office applications crashing with memory corruption errors
- Multiple document opens from email attachments
Network Indicators:
- Outbound connections from Office processes to suspicious IPs
- DNS requests for known malicious domains following document open
SIEM Query:
source="windows-security" EventCode=4688 NewProcessName contains "powershell" OR "cmd" ParentProcessName contains "winword" OR "excel" OR "powerpnt"