CVE-2023-36884

What it actually does

This vulnerability allows remote code execution when a user opens or previews specially crafted content that causes Windows Search / Office protocol handling to process attacker-controlled references. Exploitation can cross from document or web-delivered content into Windows components and result in arbitrary code execution in the context of the targeted user. Successful exploitation can provide confidentiality, integrity, and availability impact by enabling payload execution, credential theft, persistence, lateral movement tooling, or ransomware deployment. The CVSS vector indicates network delivery, no privileges required, user interaction required, and high impact across confidentiality, integrity, and availability; the high EPSS score and KEV listing indicate substantial real-world exploitation likelihood.

Why it matters to the business

Organizations that allow users to open email attachments, downloaded documents, or externally sourced Office content are exposed to compromise through normal business workflows. Because this issue is listed in CISA KEV, has active exploitation in the wild, and is marked as used in ransomware campaigns, delayed remediation materially increases the risk of endpoint compromise, data theft, business interruption, and ransomware-related outage. Systems past the KEV due date of 2023-08-29 should be treated as overdue and prioritized for emergency remediation or compensating controls.

How an attack unfolds

An attacker typically delivers a malicious document, link, or archive through phishing, social engineering, or a compromised website. The victim is persuaded to open or preview the content. The content references Windows Search / Office protocol behavior in a way that causes Windows components to retrieve or process attacker-controlled resources. If the vulnerable handling path is present and protections do not block the cross-protocol behavior, attacker-supplied code or follow-on payloads execute under the victim user's context. The attacker can then establish persistence, collect credentials and browser/session data, stage command-and-control tooling, move laterally using the compromised identity, and in ransomware campaigns deploy encryption or extortion tooling. Public exploitation and ransomware use mean defenders should assume commodity and targeted actors may both attempt this path.

How to fix it

Apply the relevant Microsoft security updates for CVE-2023-36884 and ensure Windows and Microsoft Office are fully updated on all endpoints and servers that process user-supplied documents. For the package data provided, update arduino/arduino-create-agent from source to commit 9a500b4e7c41f677c77c869b71e1a524f822866d or later if that package is in scope for the asset inventory. Where immediate patching is not possible, apply Microsoft-recommended mitigations for blocking cross-protocol file navigation through the FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION policy, restrict Office from launching child processes through Attack Surface Reduction rules, enforce Protected View for internet-sourced documents, block or warn on risky protocol handlers where feasible, and prevent Office applications from creating executable content. Remove local administrator rights from standard users and ensure endpoint detection and response controls are active.

How to confirm the fix worked

Confirm all affected Windows and Office installations have received the vendor security update that addresses this issue. Validate that Office is current through Microsoft Update, enterprise patch management, or Microsoft 365 Apps update reporting. Confirm the mitigation registry policy is present where used and that Office applications are included. Test controls by verifying that internet-sourced Office documents open in Protected View and that Office child-process creation is blocked or alerted by endpoint policy. Review vulnerability scanner results, patch compliance dashboards, and software inventory for any hosts still missing the relevant Windows or Office updates. For arduino/arduino-create-agent assets, verify deployed source or package provenance includes commit 9a500b4e7c41f677c77c869b71e1a524f822866d or a later fixed revision.

Typical attack path

1. Identify organizations whose users are likely to open externally supplied Office documents or links.
2. Send a phishing email, message, or web link containing crafted content that invokes vulnerable Windows Search / Office protocol handling.
3. Convince the user to open or preview the content.
4. Trigger retrieval or processing of attacker-controlled resources through the vulnerable protocol-handling path.
5. Execute code in the context of the current user if the system is unpatched or lacks mitigations.
6. Download second-stage malware, credential theft tools, remote access tooling, or ransomware components.
7. Establish persistence, evade detection, and use the compromised identity for lateral movement or data access.
8. Exfiltrate data and/or deploy ransomware depending on the actor objective.

How to detect it

Look for evidence that Office documents, email clients, browsers, or archive tools launched Windows Search-related protocol handlers or unusual child processes. Useful sources include EDR process telemetry, Windows Security logs, Sysmon Event IDs 1, 3, 7, 11, 15, and 22, PowerShell logs, Microsoft Defender for Endpoint advanced hunting, proxy and DNS logs, email gateway logs, Office Protected View and ASR alerts, and file creation events in user profile temporary directories. Focus on process chains where WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, OUTLOOK.EXE, or a browser spawns searchprotocolhost.exe, searchfilterhost.exe, explorer.exe, cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, curl.exe, or certutil.exe. Search email and web telemetry for embedded or clicked URIs containing search-ms:, ms-search:, mhtml:, or suspicious file:// references. Investigate document opens followed within minutes by outbound connections to newly registered or low-reputation domains, script interpreter execution, archive extraction, executable creation in Temp/AppData/Downloads, or credential access alerts. Because this vulnerability has been used in ransomware campaigns, extend hunting to signs of staging such as mass file enumeration, shadow copy deletion, backup tampering, abnormal SMB authentication, remote service creation, and encryption tooling launched after the initial document event.

• search-ms:
• ms-search:
• search-ms:query=
• mhtml:
• FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION
• HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION
• HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION
• WINWORD.EXE
• EXCEL.EXE
• POWERPNT.EXE
• OUTLOOK.EXE
• searchprotocolhost.exe
• searchfilterhost.exe
• WINWORD.EXE -> searchprotocolhost.exe
• EXCEL.EXE -> searchprotocolhost.exe
• POWERPNT.EXE -> searchprotocolhost.exe
• WINWORD.EXE -> powershell.exe
• WINWORD.EXE -> cmd.exe
• WINWORD.EXE -> wscript.exe
• WINWORD.EXE -> cscript.exe
• WINWORD.EXE -> mshta.exe
• WINWORD.EXE -> rundll32.exe
• WINWORD.EXE -> regsvr32.exe
• EXCEL.EXE -> powershell.exe
• POWERPNT.EXE -> powershell.exe
• OUTLOOK.EXE -> searchprotocolhost.exe
• %TEMP%\*.lnk
• %TEMP%\*.url
• %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.lnk
• vssadmin.exe Delete Shadows
• wmic.exe shadowcopy delete
• bcdedit.exe /set {default} recoveryenabled no
• arduino/arduino-create-agent
• 9a500b4e7c41f677c77c869b71e1a524f822866d

What your security team should do

• Treat this as urgent because it is KEV-listed, actively exploited, has a very high EPSS score, and is associated with ransomware activity.
• Prioritize patching internet-facing, high-risk user endpoints, executive/admin workstations, helpdesk systems, and systems used to handle external documents.
• Hunt for prior exploitation before closing the incident, focusing on Office spawning unusual child processes, Windows Search protocol activity, and payload downloads following document opens.
• Deploy or verify Attack Surface Reduction rules that block Office applications from creating child processes, executable content, or process injection activity.
• Enforce Protected View and Mark-of-the-Web handling for files from the internet; investigate any process or policy that strips Mark-of-the-Web from downloaded files.
• Block or alert on suspicious use of search-ms, ms-search, mhtml, and file protocol references embedded in Office documents or email-delivered content.
• Review email security telemetry for campaigns containing crafted Office documents, archives, or links delivered around and after the July 2023 publication date.
• If exploitation is suspected, isolate affected endpoints, collect forensic images or triage artifacts, rotate credentials for impacted users, and search laterally for the same payloads or command-and-control indicators.
• Verify compliance against the CISA KEV due date of 2023-08-29 and document exceptions with compensating controls and business owner approval.