Windows Search Remote Code Execution Vulnerability
CVE-2023-36884

7.5HIGH

Key Information:

Vendor

Microsoft
Status
Windows 10 Version 1809
Windows Server 2019
Windows Server 2019 (server Core Installation)
Windows Server 2022
Vendor
CVE Published:
11 July 2023

Badges

💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 91%🦅 CISA Reported📰 News Worthy

What is CVE-2023-36884?

A vulnerability exists in the Windows Search feature that could allow an attacker to execute arbitrary code on the affected system. Exploitation of this vulnerability requires an attacker to send a specially crafted request to the Windows Search interface. Successful exploitation could lead to unauthorized access to sensitive information or the ability to compromise the affected system. Microsoft recommends applying the available security updates to mitigate this risk.

CISA has reported CVE-2023-36884

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2023-36884 as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

Windows 10 Version 1507 32-bit Systems 10.0.10240.0 < 10.0.10240.20107

Windows 10 Version 1607 32-bit Systems 10.0.14393.0 < 10.0.14393.6167

Windows 10 Version 1809 32-bit Systems 10.0.17763.0 < 10.0.17763.4737

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-36884-MS-Office-HTML-RCE
Created by jakabakos

CVE-2023-36884-Scripts-for-Intune-Remediation-SCCM-Compliance-Baseline
Created by Maxwitat

CVE-2023-36884-Checker
Created by tarraschk

News Articles

favicon imageWeLiveSecurity

Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability

ESET Research discover a zero-day vulnerability in WinRAR being exploited in the wild in the guise of job application documents.

3 weeks ago

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

EPSS Score

91% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 📰

    First article discovered by WeLiveSecurity

  • 🟡

    Public PoC available

  • 💰

    Used in Ransomware

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

.