CVE-2023-35385CWE-190

CVE-2023-35385

Critical · published August 8, 2023

CVSS v3.1
9.8
EPSS
2%
Percentile
84.5
In the wild
Unconfirmed
What it is

🚨 A sneaky remote code execution vulnerability in Microsoft Message Queuing (MSMQ) could allow attackers to take full control of affected systems — that's a virtual open door! 🔥 Think of MSMQ as a busy postal service delivering messages between applications. If a malicious actor can slip in a fraudulent package, they could manipulate the delivery system to send harmful content to any receiver, wreaking havoc like a postal worker delivering a flaming package instead of a birthday gift! An attacker could exploit this vulnerability to run arbitrary code on a vulnerable system, potentially leading to data theft, system crashes, or unauthorized access to sensitive information. This type of breach could compromise your entire network, putting critical operations and data at severe risk. ⚡

Put simply

Think of MSMQ as a busy postal service delivering messages between applications. If a malicious actor can slip in a fraudulent package, they could manipulate the delivery system to send harmful content to any receiver, wreaking havoc like a postal worker delivering a flaming package instead of a birthday gift! This CVE relates to a flaw in MSMQ that allows for remote code execution when a specially crafted message is sent to the service. Due to improper validation, the service may execute malicious commands, effectively letting attackers take control of the system without authorization.

What to do

An attacker could exploit this vulnerability to run arbitrary code on a vulnerable system, potentially leading to data theft, system crashes, or unauthorized access to sensitive information. This type of breach could compromise your entire network, putting critical operations and data at severe risk. ⚡ To protect your systems, immediately update MSMQ to the patch provided by Microsoft, which addresses this vulnerability. Ensure that your network security protocols are also updated, and consider implementing additional monitoring for any suspicious activity related to message queuing. 🛡️ You've got this! By following these steps, you'll bolster your defenses and keep your systems safe from this critical threat. 💪✨

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02485 · 84.5th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2023-08-08T22:15Z
Affected products (14)
ProductVersionsFixed in
microsoft/windows_10_1507< 10.0.10240.2010710.0.10240.20107
microsoft/windows_10_1607< 10.0.14393.616710.0.14393.6167
microsoft/windows_10_1809< 10.0.17763.473710.0.17763.4737
microsoft/windows_10_21h2< 10.0.19044.332410.0.19044.3324
microsoft/windows_10_22h2< 10.0.19045.332410.0.19045.3324
microsoft/windows_11_21h2< 10.0.22000.229510.0.22000.2295
microsoft/windows_11_22h2< 10.0.22621.213410.0.22621.2134
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016all versions—
microsoft/windows_server_2019all versions—
microsoft/windows_server_2022all versions—
References (2)
EPSS history
Timeline
  • 08 AUG 17:08Z
    Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
    cvelistv5