Microsoft Message Queuing Remote Code Execution Vulnerability

Recently, a remote code execution vulnerability of MSMQ was officially announced, which may affect the business due to the update of network security equipment, which deserves everyone's attention.

Overview of Microsoft Message Queuing

MicroSoft Message Queuing (Microsoft Message Queuing) is an asynchronous transmission mode that realizes mutual communication between multiple different applications. The applications that communicate with each other can be distributed on the same machine, or distributed in any connected network space. a location. Its implementation principle is: the sender of the message puts the information he wants to send into a container (we call it Message), and then saves it in a message queue (Message Queue) in the system public space; local or It is the message receiving program in a different place and then takes out the message sent to it from the queue for processing.

Microsoft Message Queuing Vulnerability Description

Name:
Microsoft Message Queuing Remote Code Execution Vulnerability

Description:
Microsoft Message Queuing is prone to a remote code execution vulnerability while parsing certain crafted TCP requests. The vulnerability is due to the lack of proper checks on TCP requests, leading to an exploitable remote code execution vulnerability. An attacker could exploit the vulnerability by sending crafted TCP requests. A successful attack could lead to remote code execution with the privileges of the server.

Microsoft Message Queuing is prone to a remote code execution vulnerability when parsing certain crafted TCP requests. The vulnerability is due to a lack of proper inspection of TCP requests, resulting in an exploitable remote code execution vulnerability. An attacker could exploit the vulnerability by sending crafted TCP requests. A successful attack could result in remote code execution with the server's privileges.

CVE :
CVE-2023-21554

Reference:
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2023-21554

insert image description here

How could an attacker exploit this vulnerability?

To exploit this vulnerability, an attacker would need to send a specially crafted malicious MSMQ packet to the MSMQ server. This could lead to remote code execution on the server side.

The Windows Message Queuing service is a Windows component that needs to be enabled on the system to be exploited by this vulnerability.

You can check to see if there is a service called "Message Queuing" running and listening on TCP port 1801 on that computer.

Microsoft Message Queuing Vulnerability Risk Description

Impact: Remote Code Execution

Maximum Severity: Critical
insert image description here
Complete loss of confidentiality, resulting in the disclosure of all resources within the affected component to the attacker. Or, gain access to only limited information, but the disclosure of the information has immediate, serious repercussions.

Complete loss of integrity, or complete loss of protection. For example, an attacker would be able to modify any/all files protected by the affected component. Alternatively, only some files can be modified, but the malicious modification can have immediate, severe consequences for the affected components.

A complete loss of availability that results in the attacker being able to completely deny access to resources in the affected component; this loss is either ongoing (while the attacker continues the attack) or persistent (even after the attack is complete, which is the case still exists). Alternatively, the attacker has the ability to deny some availability, but the loss of availability has immediate, severe consequences for the affected components (e.g., the attacker cannot destroy existing connections, but new connections can be blocked; the attacker can reuse Vulnerabilities only leak a small amount of memory in each successful attack, but can lead to complete service unavailability after repeated exploitation).

Microsoft Message Queuing Vulnerability Fixes

insert image description here
Recently, critical denial of service and remote code execution vulnerabilities continue to occur in Microsoft Message Queuing, so friends should pay special attention.