{"id":1584,"date":"2023-08-02T12:53:26","date_gmt":"2023-08-02T12:53:26","guid":{"rendered":"https:\/\/www.bodyguard.io\/?p=1584"},"modified":"2023-08-02T12:54:36","modified_gmt":"2023-08-02T12:54:36","slug":"office-vulnerability-cve-2023-36884","status":"publish","type":"post","link":"https:\/\/www.bodyguard.io\/en\/blog\/office-vulnerability-cve-2023-36884\/","title":{"rendered":"Office vulnerability CVE-2023-36884"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"1584\" class=\"elementor elementor-1584\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-a14c161 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"a14c161\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-098e2dc\" data-id=\"098e2dc\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-01bf5ff elementor-widget elementor-widget-text-editor\" data-id=\"01bf5ff\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.21.0 - 30-04-2024 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#69727d;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#69727d;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<div class=\"flex flex-grow flex-col gap-3\"><div class=\"min-h-[20px] flex items-start overflow-x-auto whitespace-pre-wrap break-words\"><div class=\"markdown prose w-full break-words dark:prose-invert dark\"><p>CVE-2023-36884 identifies a vulnerability within the processing chain of Microsoft Office files. This weakness exploits the manner in which Office files such as Word (docx\/docm), Excel (xlsx\/xlsm), or PowerPoint (pptx\/pptm) initialize and load certain elements.<\/p><p><strong>Technical Background<\/strong><\/p><p>Upon startup of an Office document, various elements can already be loaded. An example of this is an external template. However, CVE-2023-36884 exploits the altChunk structure.<\/p><p>The abuse takes place when during the loading of the document, a reference to a subdocument is found (usually named afChunk.rtf or altChunk.rtf, but it may have a different name), and this subdocument is subsequently loaded. This process is designed to facilitate document merging, but it introduces a risk. In the case of CVE-2023-36884, the subdocument contains malicious code that executes on the system. Complicating the issue, the loading and executing of the subdocument remain invisible to the process manager.<\/p><p>All this happens before the main document even becomes visible to the user, even in protected view. This allows an attacker to gain access to the system and take control of the entire computer undetected.<\/p><p><strong>Microsoft&#8217;s Stance<\/strong><\/p><p>Currently, Microsoft advises users to disable certain features related to CVE-2023-36884, as there is yet to be a definitive fix. Regrettably, these recommended actions require complex operations that may impact computer functionality.<\/p><p><strong>Protection with CDR Technology<\/strong><\/p><p>By utilizing our Content Disarm and Reconstruction (CDR) technology, files infected with the CVE-2023-36884 attack method can safely be opened. CDR ensures that the harmful elements are removed from the file &#8211; in the case of CVE-2023-36884, this includes the subdocument and the reference to it. By focusing on preserving clean elements and removing anything that could potentially be harmful, CDR provides protection against this and similar (yet unknown) attacks.<\/p><\/div><\/div><\/div>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>CVE-2023-36884 identifies a vulnerability within the processing chain of Microsoft Office files. This weakness exploits the manner in which Office files such as Word (docx\/docm), Excel (xlsx\/xlsm), or PowerPoint (pptx\/pptm) initialize and load certain elements.<\/p>\n","protected":false},"author":4,"featured_media":1576,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"none","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","footnotes":""},"categories":[15],"tags":[],"_links":{"self":[{"href":"https:\/\/www.bodyguard.io\/wp-json\/wp\/v2\/posts\/1584"}],"collection":[{"href":"https:\/\/www.bodyguard.io\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.bodyguard.io\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.bodyguard.io\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bodyguard.io\/wp-json\/wp\/v2\/comments?post=1584"}],"version-history":[{"count":5,"href":"https:\/\/www.bodyguard.io\/wp-json\/wp\/v2\/posts\/1584\/revisions"}],"predecessor-version":[{"id":1591,"href":"https:\/\/www.bodyguard.io\/wp-json\/wp\/v2\/posts\/1584\/revisions\/1591"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.bodyguard.io\/wp-json\/wp\/v2\/media\/1576"}],"wp:attachment":[{"href":"https:\/\/www.bodyguard.io\/wp-json\/wp\/v2\/media?parent=1584"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.bodyguard.io\/wp-json\/wp\/v2\/categories?post=1584"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.bodyguard.io\/wp-json\/wp\/v2\/tags?post=1584"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}