{"id":54066,"date":"2023-10-10T23:49:48","date_gmt":"2023-10-10T23:49:48","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/its-2023-and-microsoft-wordpad-can-be-exploited-to-hijack-vulnerable-systems\/"},"modified":"2023-10-10T23:49:48","modified_gmt":"2023-10-10T23:49:48","slug":"its-2023-and-microsoft-wordpad-can-be-exploited-to-hijack-vulnerable-systems","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/its-2023-and-microsoft-wordpad-can-be-exploited-to-hijack-vulnerable-systems\/","title":{"rendered":"It’s 2023 and Microsoft WordPad can be exploited to hijack vulnerable systems"},"content":{"rendered":"

Patch Tuesday<\/span> Microsoft on Tuesday issued more than 100 security updates to fix flaws in its products, including two bugs that are already under active attack, as well as addressing an HTTP\/2 weakness that has also been exploited in the wild.<\/p>\n

That last one \u2013 tracked as CVE-2023-44487<\/a> aka Rapid Reset<\/a> \u2013 is an HTTP\/2 protocol vulnerability that has been abused since August to launch massive distributed denial of service (DDoS) attacks. Microsoft, Amazon<\/a>, Google<\/a>, and Cloudflare<\/a> all released mitigations for these server-knackering Rapid Reset attacks.<\/p>\n

But back to the Microsoft-specific CVEs that are listed as being publicly known and exploited. CVE-2023-36563<\/a> is an information disclosure bug in Microsoft WordPad that can be exploited to steal NTLM hashes.<\/p>\n

\"Goodbye<\/p>\n

Farewell WordPad, we hardly knew ye<\/h2>\n

READ MORE<\/span><\/a><\/div>\n

There are two ways to exploit this, according to Microsoft. One way is to log in as a rogue or compromised user, and “then run a specially crafted application that could exploit the vulnerability and take control of an affected system.” The other way is to trick a victim into opening a malicious file. “The attacker would have to convince the user to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file,” Redmond explained.<\/p>\n

In addition to applying the software fix, the Zero Day Initiative’s Dustin Childs also suggests users block outbound NTLM-over-SMB on Windows 11. “This new feature hasn’t received much attention, but it could significantly hamper NTLM-relay exploits,” Childs wrote<\/a>.<\/p>\n