Microsoft’s April 2023 Patch Tuesday: Two Vulnerabilities Highlighted
Summary
Microsoft patched 97 vulnerabilities in April 2023. The article details actively exploited CVE-2023-28252 and critical MSMQ flaw CVE-2023-21554, with patching and mitigation guidance.
Key points
- CVE-2023-21554 (QueueJumper) could allow unauthenticated remote code execution through MSMQ on TCP port 1801; Microsoft patched it on April 11, 2023.
- CVE-2023-28252 is an actively exploited Windows CLFS privilege-escalation flaw that can provide SYSTEM privileges.
- Researchers reported CVE-2023-28252 exploits used against Windows servers at small and medium-sized businesses in the Middle East, North America, and Asia, including to deploy Nokoyawa ransomware.
- The article links the activity to the Nokoyawa ransomware gang and says related CLFS exploits had been used since June 2022.
- Wiz reported that two days after Patch Tuesday, 84% of cloud environments had not yet updated to the latest KB.
- The article recommends installing the April updates; for MSMQ, it also suggests disabling the service if feasible or blocking untrusted inbound connections on port 1801 if patching is not possible.
Article Details
- Vulnerability Types
- Elevation of privilege
- Remote code execution
- Out-of-bounds write
- Severity
- CVE-2023-21554 is described as critical; CVE-2023-28252 severity is not stated.
- Affected Versions
- Windows releases up to the April 2023 Patch Tuesday KBs
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For CVE-2023-21554, disable MSMQ through Control Panel if it is not required.
- For CVE-2023-21554, block inbound connections to port 1801 from untrusted sources.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | devsetgroup[.]com | Domain identified as a CobaltStrike C2 server. |
| DOMAIN | qooqle[.]top | Domain identified as a CobaltStrike C2 server. |
| DOMAIN | vnssinc[.]com | Domain identified as a CobaltStrike C2 server. |
| DOMAIN | vsexec[.]com | Domain identified as a CobaltStrike C2 server. |
| MD5 | 1e4dd35b16ddc59c1ecf240c22b8a4c4 | MD5 hash identified as a CobaltStrike loader. |
| MD5 | 46168ed7dbe33ffc4179974f8bf401aa | MD5 hash identified as the CVE-2023-28252 exploit. |
| MD5 | a2313d7fdb2f8f5e5c1962e22b504a17 | MD5 hash identified as a CobaltStrike loader. |
| MD5 | f23be19024fcc7c8f885dfa16634e6e7 | MD5 hash identified as a CobaltStrike loader. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelNokoyawa uses double extortion, threatening to leak sensitive files stolen from compromised networks.T1068 · Exploitation for Privilege EscalationThe CVE-2023-28252 exploit elevates privileges to SYSTEM on Windows.T1203 · Exploitation for Client ExecutionCVE-2023-21554 can be triggered by sending a specially crafted packet to TCP port 1801, leading to remote code execution.
CVE
CVE-2023-21554Learn how to detect and mitigate CVE-2023-28252, an elevation of privilege (EoP) vulnerability in CLFS exploited in the wild, and CVE-2023-21554, a critical remote code execution (RCE) vulnerability in MSMQ.CVE-2023-28252Learn how to detect and mitigate CVE-2023-28252, an elevation of privilege (EoP) vulnerability in CLFS exploited in the wild, and CVE-2023-21554, a critical remote code execution (RCE) vulnerability in MSMQ.
Threat Actors
Malware
Vendors
Products
CLFSLearn how to detect and mitigate CVE-2023-28252, an elevation of privilege (EoP) vulnerability in CLFS exploited in the wild, and CVE-2023-21554, a critical remote code execution (RCE) vulnerability in MSMQ.Microsoft Exchange ServerMSMQ is not enabled by default in Windows, but since many applications rely on it to function (such as Microsoft Exchange Server), it is often enabled during installation of these applications. Microsoft Message QueuingResearchers published CVE-2023-21554, a critical RCE vulnerability in “Microsoft Message Queuing” service, also known as MSMQ. The vulnerability allows unauthenticated attackers to execute arbitrary code in the contextMicrosoft WindowsMSMQ. The vulnerability allows unauthenticated attackers to execute arbitrary code in the context of the Windows service process, `mqsvc.exe`. It was patched on April 11 as part of April Patch Tuesday, and dubbedMSMQLearn how to detect and mitigate CVE-2023-28252, an elevation of privilege (EoP) vulnerability in CLFS exploited in the wild, and CVE-2023-21554, a critical remote code execution (RCE) vulnerability in MSMQ.