High Severity
Attachment: CVE-2023-21716 - Microsoft Office Remote Code Execution Vulnerability
Labels
Description
Attachment contains an RTF file with a font table defining an excessive number of fonts, used to exploit CVE-2023-21716.
References
Sublime Security
Created Aug 17th, 2023 • Last updated Aug 21st, 2023
Feed Source
Sublime Core Feed
Source
type.inbound
and any(attachments,
(
.file_extension in~ ("rtf", "doc", "docx")
or .file_extension in~ $file_extensions_common_archives
or .file_extension in~ $file_extensions_macros
)
and any(file.explode(.),
any(.scan.strings.strings, strings.ilike(., '*\fonttbl*'))
and length(filter(.scan.strings.strings, strings.ilike(., '{\f*;}'))) > 10000
)
)
Playground
Test against your own EMLs or sample data.