CVE-2023-21554: MSMQ

Updates

April 15, 2023

• As stated previously, results are still coming in for the number of hosts running this MSMQ service. As of today, we have observed 465,263 MQMQ servers open to the internet.
• We have updated the graphs and metrics below to reflect this new set of hosts.

Summary

• CVE-2023-21554 is shaping up to be a very big problem if not dealt with quickly. This affects almost every version of the Windows OS running the Microsoft  Messaging Queuing service.
• Censys has observed 383,554 465,263 hosts running the obscure MSMQ service that this vulnerability targets.
• Censys Search query: services.service_name=MSMQ

Introduction

On April 12th, 2023, Microsoft released a slew of new patches for its Windows operating system, one of which was to fix CVE-2023-21554, a remotely-exploitable vulnerability in the obscure Windows Message Queuing (MSMQ) service that can lead to remote code execution (RCE). The original analysis came from researchers Wayne Low of Fortinet and Haifei Li of Check Point, where they disclosed some details and general protection information about the vulnerability.

While this service is not enabled by default on Windows servers, Check Point noted that some enterprise applications (such as Microsoft Exchange Server) will automatically start and leave it running in the background, meaning a system may be running this service without an administrator ever knowing.

The good news is that no known public exploit is available for this vulnerability. The bad news is that the advisory mentions that exploiting this service requires zero authentication and can be triggered with a single TCP packet (which may mean the exploit could be found with a bit of time and fuzzing). In other words: no known public exploit is available for this vulnerability….YET!

“…an attacker could gain control of the process through just one packet to the 1801/tcp port with the exploit” – Check Point

If the news, advisories, and CVSS score are accurate, it is only a matter of time before we see something, especially given that it is such a high-value target with a reportedly low level of complexity to execute. If an exploit is dropped, there is no doubt that threat actors will immediately start a proverbial space race to own these devices.

Whether the service is firewalled from the internet or exposed publicly for a good reason, individuals and organizations must check whether the service is running on their servers. Administrators must ensure the latest Microsoft patches have been applied if the service is intentionally enabled.

Identifying

By default, this service listens on TCP port 1801. It uses a proprietary binary protocol for data communication, but Microsoft documentation luckily includes examples of an MSMQ connection request and an MSMQ connection response. Using this information, an analyst can quickly check to determine if there is a valid MSMQ service listening on the other end by using “netcat”, with the following command:

$ echo H4sIAAAAAAACAxM4wM3g4+kfZMPEwPAfCBgYmBguRhSHBkycOtVz+rZngq/UjrF3nnX2sRTsd3GdUDFh3oI/fqfuyQowM4yCEQ4AzGv6OzwCAAA= \
  |base64 -d|zcat -|\
  netcat $IP_ADDRESS 1801 |\
  hexdump -C

If the output looks similar to the following hex dump, then the server is running MSMQ:

00000000 10 5a 0b 00 4c 49 4f 52 3c 02 00 00 ff ff ff ff |.Z..LIOR<.......|
00000010 00 00 12 00 d1 58 73 55 50 91 95 95 49 97 b6 e6 |.....XsUP...I...|
00000000 10 5a 0b 00 4c 49 4f 52 3c 02 00 00 ff ff ff ff |.Z..LIOR<.......|
00000010 00 00 12 00 d1 58 73 55 50 91 95 95 49 97 b6 e6 |.....XsUP...I...|

Alternatively, a user can check the local Windows system to determine whether the service is running by going to the Start Menu, then Control Panel, and clicking on the “Programs and Features” section. There should be an option to “Turn Windows features on or off.” From this window, we can scroll down to find an entry labeled “Microsoft Message Queue (MSMQ) Server.” If these checkboxes are enabled, this means the service is running.

MSMQ Observations

Geographic View of MSMQ Services on the Internet (via kepler.gl)

While an exploit for this vulnerability has not been published as of April 14th, 2023, it is good to know what problems could exist and at what scale if one is made available in the near future.

Censys has found that since we deployed our MSMQ scanner (on the evening of February 12th), over 465,000 hosts have been observed running the MSMQ service. Below are the continents and top ten countries where this service has been observed. Results are still trickling in, but we have seen that Hong Kong is the most significant user of MSMQ, with over 35% (167,418 hosts) of the total MSMQ hosts running this service on the internet.

As for the types of networks this service has been observed running in, we see a mix of enterprises, cloud hosting providers, and general broadband internet service providers. Here are the top ten autonomous systems and networks where we have seen MSMQ services listening (Note: this does not mean they are vulnerable, just that this MSMQ service is running):

GreyNoise (an organization that collects and analyzes data about hosts on the internet that attempt to scan or exploit vulnerabilities) has seen a recent uptick in scanning and recon activity around the MSMQ service. In the last three days, GreyNoise has noted 592 unique IP addresses attempting to find MSMQ services (a few of those are probably Censys :)).

(GreyNoise’s view of internet hosts scanning for MSMQ servers)

What can be done?

• Patch immediately!
• If unable to quickly patch or disable MSMQ on the server, configure a firewall to block untrusted connections to TCP port 1801
• Search for hosts on the internet running the MSMQ service using this Censys Search.
• Censys Attack Surface Management (ASM) customers can use this link to search for assets in the organization’s risk inventory

References

• NVD entry for CVE-2023-21554
• Check Point’s article detailing the vulnerability
• Microsoft’s MSRC Guide to CVE-2023-21554
• GreyNoise’s article
• Censys Search Query for MSMQ
• Censys ASM Search Query for MSMQ Risks