# CVE-2023-21716 (Microsoft Word RCE) Python PoC (1)
CNA: Microsoft Corporation Base Score: 9.8 CRITICAL Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Note: It is a heap corruption vulnerability in Microsoft Word’s RTF parser that, if triggered,

var unreadAlerts = '1';
Welcome back, purely_cabbage. You last visited: Today, 06:36 AM Log Out
You have one unread private message from dkota titled Welcome to the Forum!
Pages (7): 1 2 3 4 5 … 7 Next »
var go_page = 'go_page_' + $(".go_page").length; $(".go_page").last().attr('id', go_page); $(".drop_go_page").last().attr('id', go_page + '_popup'); $('#' + go_page).popupMenu(false).on('click', function() { var drop_go_page = $(this).prev('.drop_go_page'); if (drop_go_page.is(':visible')) { drop_go_page.find('.textbox').trigger('focus'); } });
New Reply

Threaded Mode CVE-2023-21716 (Microsoft Word RCE) Python PoC

cyb
Download everything in VMs!
Posts:
249
Threads:
215
Joined:
Feb 2023
Reputation:
38
Credits: 84.54€ [Donate]
View All
#1
03-07-2023, 03:51 AM
CNA: Microsoft Corporation
Base Score: 9.8 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Note:
It is a heap corruption vulnerability in Microsoft Word’s RTF parser that, if triggered, allows attackers to achieve remote code execution with the privileges of the victim. The flaw does not require prior authentication: attackers can simply send a booby-trapped RTF file to the victim(s) via email.
“Microsoft Office 2010 and later use Protected View to limit damage caused by malicious documents procured from untrusted sources. Protected View is in effect when this vulnerability manifests and thus an additional sandbox escape vulnerability would be required to gain full privileges
[You must reply to view this hidden content]
PM Rate
Report
imlikhan2017
Newbie
Posts:
2
Threads:
0
Joined:
Mar 2023
Reputation:
0
Credits: 5€ [Donate]
#2
03-22-2023, 10:53 AM
ok then
PM Rate
Reply Quote // Report
YoManHi
Newbie
Posts:
2
Threads:
0
Joined:
Mar 2023
Reputation:
0
Credits: 5€ [Donate]
#3
03-22-2023, 04:07 PM
Interesting!
Rate
Reply Quote // Report
Adonay11
Newbie
Posts:
6
Threads:
0
Joined:
Mar 2023
Reputation:
0
Credits: 5€ [Donate]
#4
03-23-2023, 01:39 AM
hello thnk you very much
PM Rate
Reply Quote // Report
F9hFHf]hfw[a0-2
Newbie
Posts:
8
Threads:
0
Joined:
Mar 2023
Reputation:
0
Credits: 5€ [Donate]
#5
03-23-2023, 05:02 AM
Let me try. Thanks.
PM Rate
Reply Quote // Report
qweqweqwe
Newbie
Posts:
9
Threads:
0
Joined:
Mar 2023
Reputation:
0
Credits: 5€ [Donate]
#6
03-24-2023, 03:14 PM
good.
PM Rate
Reply Quote // Report
qawzj
Active Member
Posts:
25
Threads:
0
Joined:
Mar 2023
Reputation:
0
Credits: 5€ [Donate]
#7
03-24-2023, 04:20 PM
PM Rate
Reply Quote // Report
getafix
Newbie
Posts:
2
Threads:
0
Joined:
Mar 2023
Reputation:
0
Credits: 5€ [Donate]
#8
03-25-2023, 05:23 AM
Thanks for sharing!
PM Rate
Reply Quote // Report
TIMOTHYLINEN82
Active Member
Posts:
27
Threads:
0
Joined:
Mar 2023
Reputation:
0
Credits: 5€ [Donate]
#9
03-26-2023, 06:15 AM

> cyb Wrote: CNA: Microsoft Corporation
> Base Score: 9.8 CRITICAL
> Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
> Note:
> It is a heap corruption vulnerability in Microsoft Word’s RTF parser that, if triggered, allows attackers to achieve remote code execution with the privileges of the victim. The flaw does not require prior authentication: attackers can simply send a booby-trapped RTF file to the victim(s) via email.
> “Microsoft Office 2010 and later use Protected View to limit damage caused by malicious documents procured from untrusted sources. Protected View is in effect when this vulnerability manifests and thus an additional sandbox escape vulnerability would be required to gain full privileges

lemmecheck
PM Rate
Reply Quote // Report
envoy1
Newbie
Posts:
6
Threads:
0
Joined:
Mar 2023
Reputation:
0
Credits: 5€ [Donate]
#10
03-28-2023, 07:44 AM (This post was last modified: 03-28-2023, 07:45 AM by envoy1.)
have you exploited it?
PM Rate
Reply Quote // Report

« Next Oldest | Next Newest »

Pages (7): 1 2 3 4 5 … 7 Next »
var go_page = 'go_page_' + $(".go_page").length; $(".go_page").last().attr('id', go_page); $(".drop_go_page").last().attr('id', go_page + '_popup'); $('#' + go_page).popupMenu(false).on('click', function() { var drop_go_page = $(this).prev('.drop_go_page'); if (drop_go_page.is(':visible')) { drop_go_page.find('.textbox').trigger('focus'); } });
New Reply

Quick Reply
Message Type your reply to this message here. Signature Disable Smilies | You have selected one or more posts to quote. Quote these posts now or deselect them.

Possibly Related Threads…
Thread | Author | Replies | Views | Last Post
| CVE-2023-22809 sudo exploit | cyb | 62 | 702 | Yesterday, 05:01 PM Last Post: AmBa
| POC for CVE-2023-34362 affecting MOVEit Transfer | DataBroker | 0 | 41 | 06-13-2023, 12:28 AM Last Post: DataBroker
| CVE-2023-29336 Win32k Privilege Escalation Vulnerability (PoC) | DataBroker | 0 | 44 | 06-10-2023, 08:03 PM Last Post: DataBroker
| QueueJumper PoC - CVE-2023-21554 | HeXsploit | 1 | 144 | 06-03-2023, 01:19 PM Last Post: ItzYesterday

- Subscribe to this thread

Users browsing this thread: purely_cabbage
var thread_deleted = "0"; if(thread_deleted == "1") { $("#quick_reply_form, .new_reply_button, .thread_tools, .inline_rating").hide(); $("#moderator_options_selector option.option_mirage").attr("disabled","disabled"); }