Critical SharePoint, Qakbot-linked flaws focus of May Patch Tuesday

Object linking and embedding

The two zero-day flaws this month are CVE-2024-30040, a security feature bypass vulnerability in Windows MSHTML Platform, and CVE-2024-30051, an elevation of privilege (EoP) vulnerability in Windows DWM Core Library.

On the first of these, Microsoft revealed how it essentially lets a malicious actor bypass object linking and embedding (OLE) protections in Microsoft 365 and Microsoft Office by getting a user to load a tainted file onto a vulnerable system via a phishing email or instant message and convincing them to manipulate it, though not necessarily to click on or open it. This would give the unauthenticated attacker the ability to execute arbitrary code presenting as the victim.

Quackers for Qakbot

On the Windows DWM Core Library vulnerability, Microsoft said it would enable an attacker to gain system-level privileges on the victim’s system, but provided little additional context or detail. It’s known to stem from a heap-based buffer overflow, which makes it potentially severe, and is also exploitable by a local user with relatively low privileges.

Of the two zero-days, it’s CVE-2024-30051 that has generated significant interest among cyber experts, due to an historic connection to an infamous threat.

Tyler Reguly, senior manager of security research and development at Fortra, explained: “This month everyone is going to be talking about CVE-2024-30051 since it is known that it is being used in QakBot and other malware. This is an update that should be applied as soon as possible given the nature of the vulnerability and the fact that real-world exploitation has been confirmed.”

Qakbot is a venerable banking malware dating back over a decade. It latterly became popular among cyber criminals as a remote access trojan (RAT) used to great effect by ransomware gangs such as LockBit and REvil.

Its infrastructure was taken down in August 2023 in an FBI-led operation dubbed Operation Duck Hunt, but as of February 2024, researchers from the Sophos X-Ops team reported that someone with access to Qakbot’s source code appeared to be testing out new builds and making concerted efforts to harden the malware’s encryption, meaning the new variant can more effectively defy analysis.

The vulnerability was found by Kaspersky researchers at the beginning of April, when a suspicious document found on VirusTotal drew their attention. Written in broken English and missing crucial details, the document hinted at a potential Windows OS vulnerability, but the exploit chain seemed identical to that used to activate a previous zero-day, CVE-2023-36033.

Suspecting the flaw to be either fictional or unexploitable nonsense, the Kaspersky team chose to probe it further, and quickly found and reported the fact CVE-2023-30051 was genuine. The team has since been monitoring for its use, and said today that an exploit has been circulating since mid-April.

“We found the document on VirusTotal intriguing due to its descriptive nature, and decided to investigate further, which led us to discover this critical zero-day vulnerability,” said Boris Larin, principal security researcher at Kaspersky GReAT. “The speed with which threat actors are integrating this exploit into their arsenal underscores the importance of timely updates and vigilance in cyber security.”

Kaspersky said it plans to release more technical details of CVE-2024-30051 once enough time has passed for vulnerable users to update.

Action1’s Walters added: “Given its critical nature and the low complexity of the exploit, CVE-2024-30051 poses a significant risk, particularly in environments with numerous and diverse local users, such as corporate networks and academic institutions.

“The existence of functional exploit code and confirmed exploitation reports suggests that attackers are well-acquainted with this vulnerability and are actively exploiting it in campaigns,” he said. “In light of the high level of privilege attainable through this exploit, it is crucial for organisations to prioritise deploying Microsoft’s official patch to mitigate potential damage.”