CVE-2023-36884-Checker

CVE-2023-36884 하드닝 적용 여부를 확인하는 스크립트 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884

목표

이 스크립트는 Microsoft 하드닝 권장 사항이 올바르게 적용되었는지 확인합니다.

Microsoft는 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884 에서 다음과 같이 설명합니다:

Add the following application names to this registry key as values of type REG_DWORD with data 1.:
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION

    Excel.exe
    Graph.exe
    MSAccess.exe
    MSPub.exe
    Powerpnt.exe
    Visio.exe
    WinProj.exe
    WinWord.exe
    Wordpad.exe

사용 방법

cve-2023-36884-checker.ps1 코드를 실행하기만 하면 아래와 같은 결과를 확인할 수 있습니다.

다운로드한 스크립트를 실행하려면:

powershell -ExecutionPolicy Bypass .\cve-2023-36884-checker.ps1

/!\ 이 스크립트는 관리자 권한이 필요하지 않습니다 /!\

참고: 필요한 경우 더 많은 옵션을 제공하는 이 훌륭한 스크립트도 사용할 수 있습니다 https://github.com/myusefulrepo/Tips/blob/master/CVE-2023-36884-Check%26Mitigation.ps1 (Olivier @Rapidhands님께 감사드립니다)

CVE-2023-36884 완화 조치 적용 또는 제거

Microsoft가 제공하는 완화 조치를 적용하려면 mitigate-cve-2023-36884.ps1을, 나중에 해당 완화 조치를 제거해야 한다면 remove-mitigations-cve-2023-36884.ps1을 실행할 수도 있습니다.

# To apply mitigations
powershell -ExecutionPolicy Bypass .\mitigate-cve-2023-36884.ps1
# To remove mitigations
powershell -ExecutionPolicy Bypass .\remove-mitigations-cve-2023-36884.ps1

/!\ 이 스크립트들은 관리자 권한이 필요합니다 /!\

이 스크립트들은 레지스트리 값을 변경하므로 시스템이 손상될 수 있음을 유의하세요. 그럴 경우 사용자 본인의 책임입니다.

CVE-2023-36884 체커의 실행 결과

다음은 cve-2023-36884-checker.ps1을 실행했을 때의 결과 예시입니다.

완화 조치가 완전히 적용된 경우

DEBUG:OK, Excel.exe has CVE-2023-36884 mitigation enabled
DEBUG:OK, Graph.exe has CVE-2023-36884 mitigation enabled
DEBUG:OK, MSAccess.exe has CVE-2023-36884 mitigation enabled
DEBUG:OK, MSPub.exe has CVE-2023-36884 mitigation enabled
DEBUG:OK, PowerPnt.exe has CVE-2023-36884 mitigation enabled
DEBUG:OK, Visio.exe has CVE-2023-36884 mitigation enabled
DEBUG:OK, WinProj.exe has CVE-2023-36884 mitigation enabled
DEBUG:OK, WinWord.exe has CVE-2023-36884 mitigation enabled
DEBUG:OK, Wordpad.exe has CVE-2023-36884 mitigation enabled
META:hardening-CVE-2023-36884|OK

완화 조치가 전혀 적용되지 않은 경우

DEBUG:KO, Excel.exe FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION should be set to 1
DEBUG:KO, Graph.exe FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION should be set to 1
DEBUG:KO, MSAccess.exe FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION should be set to 1
DEBUG:KO, MSPub.exe FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION should be set to 1
DEBUG:KO, PowerPnt.exe FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION should be set to 1
DEBUG:KO, Visio.exe FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION should be set to 1
DEBUG:KO, WinProj.exe FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION should be set to 1
DEBUG:KO, WinWord.exe FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION should be set to 1
DEBUG:KO, Wordpad.exe FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION should be set to 1
META:hardening-CVE-2023-36884|KO

완화 조치가 부분적으로 적용된 경우

DEBUG:KO, Excel.exe FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION should be set to 1
DEBUG:KO, Graph.exe FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION should be set to 1
DEBUG:KO, MSAccess.exe FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION should be set to 1
DEBUG:KO, MSPub.exe FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION should be set to 1
DEBUG:KO, PowerPnt.exe FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION should be set to 1
DEBUG:KO, Visio.exe FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION should be set to 1
DEBUG:KO, WinProj.exe FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION should be set to 1
DEBUG:OK, WinWord.exe has CVE-2023-36884 mitigation enabled
DEBUG:KO, Wordpad.exe FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION should be set to 1
META:hardening-CVE-2023-36884|KO

라이선스

MIT