No zero-days for June Patch Tuesday, but plenty to chew over

Exchange vulnerabilities: Always a popular choice

Elsewhere, two RCE vulns in Microsoft Exchange Server – CVE-2023-32031 and CVE-2023-28310 – also warrant close attention.

The first of these vulnerabilities enables a malicious actor to trigger code in the context of the Exchange Server account via a network call. The second enables them to execute code via PowerShell. In both cases, the attack complexity is considered low and no user interaction is needed.

Although neither of these flaws have been publicly disclosed or are known to be being exploited in the wild, Exchange Server bugs attract a particularly “sophisticated” type of cyber criminal, so should not be left to linger too long.

“This pair of vulnerabilities…are standouts, as they closely mirror the vulnerabilities identified as part of ProxyNotShell exploits,” said Kev Breen, Immersive Labs director of cyber threat research.

Breen said that these vulnerabilities will likely be exploited via social engineering attacks with spear-phishing to gain access to a host.

“If an attacker were able to gain this level of access to an Exchange Server [they] could do a lot of damage to an organisation,” he said.

“With the ability to gain access to read every email that has been sent and received, or even to impersonate any given user, this could be advantageous for financially motivated criminals where business email compromise (BEC) attacks are no longer from spoofed accounts but from the legitimate email holder.”

Critical bugs could still sting

The June Patch Tuesday update contains a total of six critical vulnerabilities, which are, in CVE number order:

• CVE-2023-24897, a remote code execution (RCE) vulnerability in .NET, .NET Framework and Visual Studio;
• CVE-2023-29357, an EoP vulnerability in Microsoft SharePoint Server;
• CVE-2023-29363, an RCE vulnerability in Windows Pragmatic General Multicast (PGM);
• CVE-2023-32013, a denial of service (DoS) vulnerability in Windows Hyper-V;
• CVE-2023-32014, a second RCE vulnerability in Windows PGM;
• CVE-2023-32015, a third RCE vulnerability in Windows PGM.

Adam Barnett, Rapid7 lead software engineer, noted that this is the third month on the trot in which Microsoft has fixed RCE vulnerabilities in Windows PGM. While Microsoft has not detected exploitation of disclosure for any of these yet, their high CVSS base scores will likely attract the wrong kind of attention in short order.

“All three PGM critical RCEs require an attacker to send a specially-crafted file over the network in the hope of executing malicious code on the target asset,” said Barnett.

“Defenders who successfully navigated last month’s batch of PGM vulnerabilities will find both risk profile and mitigation/remediation guidance very similar; CVE-2023-29363 was reported to Microsoft by the same researcher as last month’s CVE-2023-28250,” he said.

“As with previous similar vulnerabilities, only systems where Windows Message Queueing Service (MSMQ) is enabled are exploitable, and it isn’t enabled by default.”

However, as Rapid7 researchers have previously noted, a good number of applications, Microsoft Exchange among them, introduce MSMQ during their installation routine. With several prolific researchers active in this area, said Barnett, more PGM vulnerabilities will almost certainly be heading down the pipe in future.

Meanwhile, the EoP flaw in SharePoint, which gives attackers a short at gaining admin rights on the SharePoint host provided they have spoofed the right tokens, should also be addressed quickly, said Barnett, particularly if running SharePoint 2016.

“At time of writing, the FAQ provided with Microsoft’s advisory suggests that both SharePoint Enterprise Server 2016 and SharePoint Server 2019 are vulnerable, but neither the advisory nor the SharePoint 2016 Release history list any related patches for SharePoint 2016. Defenders responsible for SharePoint 2016 will no doubt wish to follow up on this one as a matter of some urgency,” he said.

Finally, the RCE vulnerability in .NET, etc, which requires an attacker to convince the victim to open a specially-crafted malicious file, typically from a website, should also raise eyebrows.

“Although Microsoft has no knowledge of public disclosure or exploitation in the wild, and considers exploitation less likely, the long list of patches – going back as far as .NET Framework 3.5 on Windows 10 1607 – means that this vulnerability has been present for years,” said Barnett.