Vulnerabilities are one of the ways to bypass any organization’s defenses. Of late, we have seen a rising trend in new vulnerabilities and unpatched vulnerabilities which are being exploited  by threat actors to gain access to sensitive data.. In this blog, we would like to talk about some of the key 2023 vulnerabilities which were mainly exploited in the wild. 

  • CVE-2023-28252– Windows Common Log File System Driver Elevation of Privilege Vulnerability.
  • CVE-2023-7024– Google Chromium WebRTC Heap Buffer Overflow Vulnerability.
  • CVE-2023-23397– Microsoft Outlook Elevation of Privilege Vulnerability.
  • CVE-2023-34362– Progress MOVEit Transfer SQL Injection Vulnerability.
  • CVE-2023-38831– RARLAB WinRAR Code Execution Vulnerability.
  • CVE-2023-21674– Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability.
  • CVE-2023-23376– Windows Common Log File System Driver Elevation of Privilege Vulnerability.
  • CVE-2023-32434– Apple Multiple Products Integer Overflow Vulnerability.
  • CVE-2023-41763– Skype for Business Elevation of Privilege Vulnerability.
  • CVE-2023-36033– Windows DWM Core Library Elevation of Privilege Vulnerability.

Now let’s dive into these.


Windows Common Log File System Driver Elevation of Privilege Vulnerability

Common Log File System (CLFS) is a general-purpose logging subsystem in Windows that is accessible to both kernel-mode as well as user-mode applications for building high-performance transaction logs. The CLFS driver is also responsible for providing support for transaction logs in Windows. 

This out-of-bounds memory read/write vulnerability was exploited by Nokoyawa Ransomware group, a well known ransomware family active from Feb 2022. They targeted  Microsoft Windows servers of small and medium-sized companies present in North America, Middle-East and ASEAN countries. The patch for this CVE-2023-28252 was released in April 2023, as a part of April Patch Tuesday [1].

Exploit for this vulnerability is publicly available  [IOC-1].

CVSS score: 7.8

Affected Version(s):

  1. Windows 10, 11
  2. Windows Server 2008, 2016, 2019, 2022


Google Chromium WebRTC Heap Buffer Overflow Vulnerability 

Google‘s Chromium WebRTC is a free, open-source project that allows web browsers and mobile applications to integrate real-time peer-to-peer connection for quick audio and video communication functionality. You can communicate directly inside web pages and applications without requiring additional plug-ins with these WebRTC data channels using Javascript APIs.

For this exploitation, the attacker would need to craft a HTML page which on clicking would lead to the exploitation of the vulnerability allowing attackers to escape the sandbox and run malicious code remotely to exploit heap corruption [2].. 

The vulnerability has been reported to be weaponised by the NSO group, an Israeli cyber-intelligence firm notoriously known for its proprietary spyware Pegasus and sells these exploits primarily to Nation State Governments. 

CVSS score: 8.8

Affected Version(s): Chromium < 120.0.6099.129


Microsoft Outlook Elevation of Privilege Vulnerability

Outlook has been exploited a lot in the past and more vulnerabilities keep getting discovered. This year, threat actors exploited CVE-2023-23397 using Messaging Application Programming Interface (MAPI) property to trigger a Net-NTLMv2 hash leak to their controlled servers.

Exploitation begins when an attacker initializes PidLidReminderFileParameter in a malicious calendar invite in .msg format supported by Outlook, containing a Universal Naming Convention (UNC) path pointing to an attacker controlled server (SMB over TCP 445). If Outlook is running in background then without any user interaction, the invite will trigger the bug using API endpoint PlayReminderSound and while connecting to the attacker’s remote SMB server, the user sends the negotiation message with Net-NTLMv2 hash. This hash can be used by an attacker to extract the password of the user’s account or use it as a relay message for NTLMv2 authentication against other systems [3]

The initial reports of the exploitation attempts were limited to threat actors based in Russia targeting Ukrainian infrastructure since the conflict started between both the countries. But soon these threat actors started targeting other governments, military and energy sectors too with the latest exploitation in Dec 2023. As Outlook is used globally by the governments, organizations, industries, etc., the risk of an increasing number of attacks remains persistent since this vulnerability affects all the versions of Outlook available for Windows.

Known IP address list associated with this vulnerability is available here  [IOC-2]:

CVSS score: 9.8

Affected Version(s): 

  1. Microsoft Outlook 2013, 2016.
  2. Microsoft Office 2019, LTSC 2021.
  3. Microsoft 365 Apps.


Progress MOVEit Transfer SQL Injection Vulnerability

MOVEit Transfer is a commercial secure managed file transfer software solution that enables secure transfer of files between organizations and their customers using SFTP, SCP and HTTP-based uploads. In May 2023, a security advisory was released by the Progress stating the presence of critical SQL injection vulnerability in MOVEit Transfer and Cloud Software web application, which could lead to unauthorized administrative access, remote code execution and data exfiltration [4].

Exploitation takes place due to a bug in MOVEitISAPI.dll file. This dll file incorrectly extracts the HTTP headers sent through a POST request leading to the generation of a Cross Site Request Forgery (CSRF) token. This CSRF token is then used to create a session and trigger a SQL injection at guestaccess.aspx. Session_vars headers (inside POST request) containing injected value are treated as a list of email addresses and MOVEit application then splits the list with commas as delimiters before passing it to SQL engine. Then we can create a JSON web token that helps in obtaining sysadmin API access token and use it to abuse a deserialization call thereby performing a remote code execution on the target machine [IOC-3].

Microsoft  [11] and Mandiant  [12],, both attributed the CLOP ransomware gang to having used this vulnerability as a Zero-day attack. Mandiant, a subsidiary of Google, tracked some of the activities and came to a conclusion that “a lot of opportunistics attacks  can be done against a wide range of industries based in India, Canada, Germany, Italy. etc.”

CVSS score: 9.8

Affected Version(s): MOVEit Versions before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1)


RARLAB WinRAR Code Execution Vulnerability

WinRAR is a widely used compression utility around the world today. In August 2023, WinRAR fixed a vulnerability which was reported to have been exploited in the wild since April, 2023. Threat actors crafted RAR archives that serve as carriers for various malware families. In one such real life attack scenario against traders, as soon as the maliciously crafted rar is extracted and a benign file in it is executed, the malware gets triggered and  allows threat actors to withdraw money from broker accounts [5] . 

Consider this following rar archive structure:

Fig. 1: Archive structure

When a user double-clicks on a benign “poc.jpg_” (underscore represents a space character) from WinRAR’s user interface, it will execute the malicious payload (“poc.jpg_.cmd”).

WinRar creates a temp directory and iterates through all the files and directories that exist in the SFX(self-extracting) archive. However, due to the way the matching is made, if a directory is found with the same name, both the selected file and the files inside a matched directory are extracted to the root of a random temporary directory. Windows doesn’t allow files with trailing spaces so while writing contents of the files, WinRAR performs a path normalization technique to remove appended spaces.

Non-normalized path i.e., “%TEMP%\{random_directory}\poc.png_” having a trailing space selected by the user is executed by the ShellExecuteExW() function. This function fails to identify the file extensions using the “shell32!PathFindExtension” function. So, ShellExecute calls upon “shell32!ApplyDefaultExts” to look for the files having default extension like .cmd, .exe, .bat, etc., and executes the first matched file 

Note: Space in any position in the file extension is sufficient to trigger the bug.

WinRar vulnerability was reported to be heavily used by threat actors attributed to Russian Armed Forces against Ukraine e.g.,FROZENBARENTS impersonates Ukrainian drone training school to deliver Rhadamanthys infostealer, FROZENLAKE spear-phishing campaign targeting Ukrainian government organizations hosted on API endpoint testing services, FROZENLAKE using IRONJAW with reverse SSH shell. Recently, there were reports of Chinese government backed groups attacking Papua New Guinea with ISLANDDREAMS delivering BOXRAT in campaign.

Exploit samples for this vulnerability are available in the public domain  [IOC-4]:

CVSS score: 7.8

Affected Version(s): Winrar < 6.23


Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

An advanced local procedure call (ALPC) is an interprocess communication facility for high-speed message exchange in Windows systems.

To exploit this sandbox escape vulnerability, an attacker would need access to a machine’s browser either by tricking the user to open a malicious link or gaining physical access to the machine. Then the attacker can try to escape the browser’s sandbox by corrupting the kernel’s memory inside the environment which leads to gaining SYSTEM privileges in vulnerable systems, allowing them to install software, modify data, and perform other malicious activities [6].

CVSS score: 8.8

Affected Version(s): 

  1. Windows 8.1, 10, 11.
  2. Windows Server 2008, 2012, 2016, 2019, 2022.
  3. Windows RT


Windows Common Log File System Driver Elevation of Privilege Vulnerability

The CLFS driver has multiple CVEs to its name. We already mentioned one earlier and this is one other vulnerability that rises to the top.  In this case, the improper handling of objects in memory allows an attacker to execute arbitrary code in kernel mode.

Using this vulnerability, an attacker could take control of the affected system and execute code with elevated privileges. This permission can allow the attacker to perform malicious activities on the victim’s machine compromising the confidentiality, integrity, and availability of the system and its data [7].

CVSS score: 7.8

Affected Version(s): 

  1. Windows 10, 11.
  2. Windows Server 2008, 2012, 2016, 2019, 2022.


Apple Multiple Products Integer Overflow Vulnerability

A critical vulnerability has been uncovered in the iOS, iPadOS, and macOS kernel components, resulting from unspecified processing of an unknown input, resulting in an integer overflow vulnerability in which the product performs a calculation assuming the logic that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. Due to this issue, an app may be able to execute arbitrary code with kernel privileges  [8]

Apple is aware of a report that this issue may have been actively exploited against versions across multiple Apple products.

CVSS score: 7.8

 Affected Version(s): 

  1. Apple Safari macOS Ventura, macOS Big Sur, macOS Monterey, iOS and iPad OS
  2. iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPhone 8 and later, iPad Pro (all models), iPad Air 2, iPad Air 3rd generation and later, iPad 5th generation and later, iPad mini (4th generation), iPad mini 5th generation and later, iPod touch (7th generation)


Skype for Business Elevation of Privilege Vulnerability

Skype for Business is an enterprise software application for instant messaging and video telephony developed by Microsoft and offered as part of Office.

When an attacker crafts a malicious link with an ‘HTTP request’ embedded in it, and persuades a victim who is present in an enterprise network to open the malicious link, it could potentially result in revealing internal IP addresses and/or port number. These IP addresses can then be used to launch further attacks [9]

CVSS score: 5.3

Affected Version(s):  Skype for Business_server 2015 CU13, Skype for Business_server 2019 CU7


Windows DWM Core Library Elevation of Privilege Vulnerability

According to wikipedia  [13]:

“ The Desktop Window Manager is a compositing window manager, meaning that each program has a buffer that it writes data to; DWM then composites each program’s buffer into a final image. It enables the use of hardware acceleration to render the graphical user interface of Windows.”

The vulnerability is present inside dwmcore.dll library file of Desktop Window Manager app. The method named CKeyframeAnimation::SampleStartingValue is used to trigger the bug. After the dereferencing data pointer process using Microsoft::WRL::ComPtr<CPatjData>::operator= function call, the attacker is able to leak heap address and execute shell code to gain SYSTEM access confirming the presence of privilege escalation vulnerability  [10].   

PoC for this vulnerability are available in public domain  [IOC-5].:

CVSS score: 7.8

Affected Version(s): 

  1. Windows 10, 11.
  2. Windows Server 2019, 2022. 

We recommend all our users to keep their OS and application up-to-date by installing the latest patch. Use a trusted product such as K7 Total Security to protect against malicious attacks. K7 products have vulnerability scanners which can identify and flag vulnerable components installed on your machine.


IOC – 1 : CVE-2023-28252
IOC – 2 : CVE-2023-23397
IOC – 3 : CVE-2023-34362
5b566de1aa4b2f79f579cdac6283b33e98fdc8c1cfa6211a787f8156848d67ff6015fed13c5510bbb89b0a5302c8b95a5b811982ff6de9930725c4630ec4011d4359aead416b1b2df8ad9e53c497806403a2253b7e13c03317fc08ad3b0b95bf7c39499dd3b0b283b242f7b7996205a9b3cf8bd5c943ef6766992204d46ec5f1 Full detailed lists mentioned here.Paths:D:\MOVEitDMZ\wwwroot\human2.aspxE:\MOVEitTransfer\wwwroot\human2.aspxC:\Windows\Temp\erymbsqv\erymbsqv.dll
IOC – 4 : CVE-2023-38831
IOC – 5 : CVE-2023-36033


[1]. vulnerability/cve-2023-28252

[2]. stable-channel-update-for-desktop_20.html

[3]. guidance-for-investigating-attacks-using-cve-2023-23397/

[4]. cve-2023-34362-moveit-transfer-exploitation-analysis/ 


[6]. advisory/cve-2023-21674

[7]. vulnerability/cve-2023-23376


[9]. advisory/cve-2023-41763

[10]. cve-2023-36033.html

[11]. msftSecIntel/status/1665537730946670595

[12]. mandiant/zero-day-moveit-data-theft

[13]. wiki/Desktop_Window_Manager

Like what you're reading? Subscribe to our top stories.

If you want to subscribe to our monthly newsletter, please submit the form below.

    0 replies on “2023 Top Vulnerabilities”