CVE-2023-21715

What it actually does

CVE-2023-21715 is a Microsoft Publisher security feature bypass that can allow a specially crafted Publisher document to evade Office protections such as Mark-of-the-Web, Protected View, or macro-related security controls that are intended to restrict untrusted documents. Exploitation requires local execution context, low privileges, and user interaction: a victim must open a malicious file. Successful exploitation can lead to execution of attacker-controlled active content or follow-on payloads with the privileges of the user running Publisher, enabling confidentiality, integrity, and availability impact through subsequent malware execution. The provided package metadata references tensorflow/tensorflow fixed at commit 874bda09e6702cd50bac90b453b50bcc65b2769e, but that does not align with the Microsoft Publisher vulnerability description and should be treated as a feed-mapping discrepancy unless independently confirmed by the package advisory source.

Why it matters to the business

This issue is high urgency because it is listed in CISA KEV, has documented active exploitation in the wild, and had a federal remediation deadline of 2023-03-07. An attacker can use a malicious Publisher file in phishing or social-engineering attacks to bypass expected Office document safeguards and gain a foothold on user workstations. Business consequences include malware infection, credential theft, data access under the victim user's permissions, lateral movement, disruption of endpoint operations, and increased risk from targeted intrusion activity. Organizations that allow Publisher documents from email, web downloads, collaboration platforms, or external partners face elevated exposure, especially where Office patching or attachment controls are inconsistent.

How an attack unfolds

An attacker prepares a malicious Microsoft Publisher document designed to bypass Office security checks that normally restrict untrusted files. The document is delivered to a user through email, file-sharing, instant messaging, compromised websites, or another social-engineering channel. The attacker convinces the user to open the file in Microsoft Publisher. When opened on an unpatched system, the document bypasses the intended security feature and can enable malicious embedded content, scripting, or a staged payload to execute in the user's context. The attacker then uses that execution to run additional commands, retrieve malware, steal credentials or files accessible to the user, establish persistence, and move laterally if endpoint and identity controls permit it. Because this vulnerability has been actively exploited, investigations should assume malicious Publisher files may have been used as initial access lures rather than relying only on commodity malware indicators.

How to fix it

Apply the Microsoft security updates that address CVE-2023-21715 for Microsoft Publisher / Microsoft Office across all supported Windows endpoints. Because this vulnerability is in CISA KEV and exploitation is active, prioritize internet-facing workstations, users with high email exposure, privileged users, finance/legal/HR staff, and systems allowed to open Office attachments. If immediate patching is not possible, reduce exposure by blocking or quarantining Publisher .pub attachments from external sources, disabling Publisher where not business-critical, enforcing Attack Surface Reduction rules for Office child-process creation and executable content, requiring Protected View for internet-originated files, and preventing users from enabling active content in untrusted documents. Validate that Office Click-to-Run, Microsoft 365 Apps, and MSI-based Office installations are receiving the relevant security update channel. If package scanners report tensorflow/tensorflow for this item, verify the advisory mapping; the supplied commit 874bda09e6702cd50bac90b453b50bcc65b2769e may be relevant to a separate dependency finding but should not be considered remediation for Microsoft Publisher unless the package advisory explicitly ties it to the affected asset.

How to confirm the fix worked

Confirm exposure by inventorying systems with Microsoft Publisher or Office suites that include Publisher and comparing installed build numbers against Microsoft's security update guidance for February 2023 or later. Validate that Office update channels are current and that endpoints have successfully installed the security update, not merely downloaded it. Test policy mitigations by attempting to deliver or open externally sourced .pub files and confirming they are blocked, quarantined, or opened with appropriate restrictions. Review email gateways, EDR, and endpoint telemetry for any remaining ability of MSPUB.EXE to spawn scripting engines, command shells, installers, archive tools, or network download utilities. Where scanner results mention tensorflow/tensorflow fixed in commit 874bda09e6702cd50bac90b453b50bcc65b2769e, validate that finding separately in source-control or dependency inventory and reconcile it with the Microsoft Publisher advisory to avoid false remediation status.

Typical attack path

1. Attacker crafts a malicious Microsoft Publisher .pub document that abuses the security feature bypass.
2. Attacker delivers the document through phishing, external file sharing, chat, removable media, or a compromised website.
3. User opens the document in Microsoft Publisher on an unpatched or insufficiently protected endpoint.
4. Publisher fails to enforce the expected security restriction for the untrusted document.
5. Malicious content launches a child process, script interpreter, downloader, or embedded payload under the user's privileges.
6. Attacker downloads or executes second-stage tooling such as credential theft, remote access, or reconnaissance utilities.
7. Attacker attempts persistence, data access, privilege escalation, or lateral movement depending on the user's access and endpoint defenses.

How to detect it

Look for evidence of malicious Publisher document handling and post-open execution. Primary log sources are EDR process telemetry, Windows Security event 4688 process creation logs, Sysmon event IDs 1, 3, 7, 11, 15, and 22, Microsoft Defender for Endpoint advanced hunting, email gateway attachment logs, proxy/DNS logs, and Office/Microsoft 365 audit records where available. Hunt for MSPUB.EXE opening files from Downloads, Temp, email cache, browser cache, OneDrive/SharePoint sync folders, ZIP extraction directories, or removable media, followed shortly by child processes such as PowerShell, command shells, script hosts, mshta, rundll32, regsvr32, certutil, bitsadmin, curl, wget, installers, or archive utilities. Review email logs for inbound .pub attachments, renamed or archived Publisher documents, and messages that prompted users to open external documents. On endpoints, preserve suspicious .pub files, their Zone.Identifier alternate data streams, prefetch files, recent-file artifacts, Office file MRUs, Amcache/Shimcache, PowerShell operational logs, downloaded payloads, and browser download history. Network detection should focus on outbound connections that occur immediately after MSPUB.EXE execution or child-process launch, especially to newly registered domains, file-sharing services, paste sites, cloud object storage, or direct IP addresses. Because this flaw is known to be exploited in the wild, absence of a known malware hash is not sufficient; prioritize behavioral chains involving Publisher-to-script or Publisher-to-downloader execution.

• MSPUB.EXE
• *.pub
• Zone.Identifier
• MSPUB.EXE -> powershell.exe
• MSPUB.EXE -> cmd.exe
• MSPUB.EXE -> wscript.exe
• MSPUB.EXE -> cscript.exe
• MSPUB.EXE -> mshta.exe
• MSPUB.EXE -> rundll32.exe
• MSPUB.EXE -> regsvr32.exe
• MSPUB.EXE -> certutil.exe
• MSPUB.EXE -> bitsadmin.exe
• MSPUB.EXE -> curl.exe
• MSPUB.EXE -> wget.exe
• MSPUB.EXE -> msiexec.exe
• MSPUB.EXE -> schtasks.exe
• MSPUB.EXE -> conhost.exe
• Image=*\MSPUB.EXE ParentImage=*\OUTLOOK.EXE
• Image=*\MSPUB.EXE CommandLine=*\Downloads\*.pub
• Image=*\MSPUB.EXE CommandLine=*\AppData\Local\Temp\*.pub
• Image=*\MSPUB.EXE CommandLine=*\Content.Outlook\*.pub
• Image=*\MSPUB.EXE CommandLine=*\INetCache\*.pub
• HKCU\Software\Microsoft\Office\*\Publisher\Security\VBAWarnings
• HKCU\Software\Microsoft\Office\*\Publisher\Security\ProtectedView
• Microsoft-Windows-PowerShell/Operational Event ID 4104 with HostApplication containing MSPUB.EXE
• Sysmon Event ID 1 Image ending with \MSPUB.EXE and child Image ending with \powershell.exe
• Sysmon Event ID 1 Image ending with \MSPUB.EXE and child Image ending with \cmd.exe
• Sysmon Event ID 3 SourceImage ending with \MSPUB.EXE
• Sysmon Event ID 15 TargetFilename ending with .pub:Zone.Identifier

What your security team should do

• Treat this as an actively exploited vulnerability and prioritize remediation ahead of non-KEV issues with similar scores.
• Patch or update all Microsoft Publisher / Office installations, with priority for users likely to receive external documents.
• Block or detonate external .pub attachments at email and collaboration gateways until patch compliance is verified.
• Enable or enforce Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes, creating executable content, and injecting into other processes.
• Hunt for MSPUB.EXE spawning powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, curl.exe, bitsadmin.exe, or other living-off-the-land binaries.
• Review historical email, proxy, and EDR telemetry around the KEV disclosure and remediation window, especially before and after 2023-03-07.
• Disable Microsoft Publisher or remove file associations where the application is not required for business use.
• Add heightened monitoring for users who opened Publisher documents from external senders or untrusted locations.
• Reconcile the conflicting affected-product metadata before closing package-based findings; do not rely on a TensorFlow commit as evidence that Microsoft Publisher endpoints are remediated.
• Update incident response playbooks for malicious Office document initial access, including collection of the original document, Zone.Identifier alternate data streams, process trees, and downloaded payloads.