CVE-2023-41763
Microsoft Skype for Business Privilege Escalation Vulnerability
Description
CVE-2023-41763 is a medium-severity server-side request forgery (SSRF) vulnerability in Microsoft Skype for Business Server. This vulnerability allows an unauthenticated, remote attacker to send crafted requests to the Skype for Business Server, which then makes unintended server-side requests that can disclose sensitive internal information. The SSRF flaw enables attackers to access internal network resources and potentially retrieve confidential data such as internal IP addresses, service configurations, or other sensitive metadata. CISA has confirmed active exploitation of CVE-2023-41763 and added it to its Known Exploited Vulnerabilities catalog, with an EPSS score of 12.7% indicating a meaningful probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | skype for business server | 2015; 2019 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41763(US Government Resource)
Weakness Type
CWE-918: Server-Side Request Forgery (SSRF)
Server-side request forgery occurs when an application can be tricked into making HTTP requests to arbitrary destinations chosen by the attacker, typically targeting internal services that are not directly accessible from the internet. In CVE-2023-41763, Microsoft Skype for Business Server processes attacker-controlled input in a way that allows the server to make unintended requests, exposing internal network information to the attacker.
Learn more: CWE-918 — Server-Side Request Forgery (SSRF)
Impact Analysis
CVE-2023-41763 carries a CVSS score of 5.3 (Medium), reflecting a limited but meaningful security impact. The vulnerability is remotely exploitable without physical access, requires no authentication, involves no user interaction, and exploitation is easy with no special conditions needed. Confidentiality (Low): the attacker can obtain limited sensitive information through server-side request forgery, such as internal network details, service configurations, or metadata that may facilitate further attacks. Integrity (None): the vulnerability does not allow modification of data on the server. Availability (None): exploiting this SSRF vulnerability does not impact the availability of the Skype for Business Server. While the direct impact is constrained to information disclosure, the disclosed information can serve as reconnaissance for more severe attacks against internal infrastructure. The EPSS score of 12.7% places this vulnerability in the 94th percentile for exploitation probability.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-41763 in the wild and has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of October 31, 2023. The EPSS score of 12.7% indicates a meaningful probability of exploitation, placing this vulnerability in the 94th percentile. While the ransomware association is currently listed as unknown, the SSRF nature of this vulnerability makes it particularly valuable as a reconnaissance tool for attackers targeting internal networks. Microsoft has released a patch and vendor advisory at the Microsoft Security Response Center.
Remediation
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Microsoft has released a security update addressing CVE-2023-41763 — apply the patch from the Microsoft Security Response Center to all affected Skype for Business Server installations.
- Update Microsoft Skype for Business Server to the latest cumulative update that includes the fix for this SSRF vulnerability. Verify the patch installation status across all Skype for Business Server instances in your environment.
- Restrict outbound network access from Skype for Business Server instances using firewall rules and network segmentation. Implement egress filtering to prevent the server from making requests to internal resources that should not be accessible, limiting the impact of SSRF exploitation.
- Monitor Skype for Business Server logs for unusual request patterns that may indicate SSRF exploitation attempts, such as requests targeting internal IP addresses, cloud metadata endpoints, or other unexpected destinations. Deploy network intrusion detection to identify anomalous outbound connections from the server.
- Evaluate the continued necessity of Skype for Business Server in your environment, as Microsoft has been transitioning customers to Microsoft Teams. Reducing the deployment footprint limits the overall attack surface.
Technical Details
CVE-2023-41763 is a server-side request forgery (CWE-918) vulnerability in Microsoft Skype for Business Server where the application processes user-supplied input to construct server-side HTTP requests without adequate validation of the target destination. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms that the vulnerability is network-accessible with low attack complexity and requires no privileges or user interaction, though the scope remains unchanged and impact is limited to low confidentiality disclosure. An attacker sends a specially crafted request to the Skype for Business Server, which causes the server to initiate requests to attacker-specified internal or external destinations. The server's response to these forged requests can reveal internal network topology, service configurations, and other sensitive metadata that the attacker would not normally be able to access from an external position.
Frequently Asked Questions
Is CVE-2023-41763 being actively exploited?
Yes, CVE-2023-41763 is being actively exploited. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of October 31, 2023. The EPSS score of 12.7% confirms a meaningful probability of exploitation, though ransomware association is currently listed as unknown.
What products are affected by CVE-2023-41763?
CVE-2023-41763 affects Microsoft Skype for Business Server. Organizations running on-premises Skype for Business Server deployments should verify their patch status and apply the security update provided by Microsoft.
How do I fix CVE-2023-41763?
Apply the security update from Microsoft available through the Microsoft Security Response Center update guide. Additionally, implement egress filtering and network segmentation to restrict outbound requests from Skype for Business Server instances, limiting the potential impact of SSRF exploitation.
How severe is CVE-2023-41763?
CVE-2023-41763 is rated Medium severity with a CVSS score of 5.3 out of 10.0. The vulnerability is limited to information disclosure through server-side request forgery, with no direct impact on data integrity or service availability. It ranks in the 94th percentile for exploitation probability (EPSS score of 12.7%), and while the direct impact is limited, the disclosed information can facilitate more severe follow-up attacks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.