# Microsoft Patches Three Actively Exploited Flaws

Published: 2023-10-10 · Severity: high
Canonical: https://vorant.io/reports/1b9f0cc6-4fe6-544d-ae45-6b2b31c41e45/microsoft-patches-three-actively-exploited-flaws

> IPA Japan warns that three Microsoft vulnerabilities, including the HTTP/2 Rapid Reset DDoS flaw, are being actively exploited and urges immediate patching.

The Information-technology Promotion Agency (IPA) of Japan issued an alert following Microsoft's October 2023 Patch Tuesday release, highlighting three vulnerabilities that Microsoft has confirmed are being actively exploited in the wild: CVE-2023-41763 (Skype for Business elevation of privilege), CVE-2023-36563 (Microsoft WordPad information disclosure), and CVE-2023-44487 (HTTP/2 Rapid Reset denial-of-service).

Of these, CVE-2023-44487 is the most consequential. The HTTP/2 Rapid Reset technique abuses stream cancellation in the HTTP/2 protocol to generate massive request volumes with minimal client resources, enabling record-breaking distributed denial-of-service attacks against servers and cloud infrastructure that support HTTP/2, including Microsoft's own services. This vulnerability affected a broad swath of internet infrastructure beyond Microsoft products, as it stems from a protocol-level design weakness rather than a single vendor implementation flaw.

IPA advises all users and administrators to apply Microsoft's October security updates immediately via Windows Update, given the confirmed active exploitation and the risk of expanding attacks. No specific threat actor or campaign is named in this advisory.

## Mentioned in this report

- Vulnerabilities: CVE-2023-36563 (KEV), CVE-2023-41763 (KEV), CVE-2023-44487 (KEV)

## Detection guidance (public sample)

### Potential HTTP/2 Rapid Reset DoS Activity (CVE-2023-44487)

ATT&CK: T1499

Detects web/proxy log entries showing HTTP/2 requests immediately followed by client-initiated stream resets (sc-status 400/499) — the hallmark of the HTTP/2 Rapid Reset flood technique; a genuine attack will show this pattern repeated at very high volume (hundreds-to-thousands per second) from one or few source IPs within seconds, which should be confirmed via SIEM-side rate aggregation outside this rule. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Potential HTTP/2 Rapid Reset DoS Pattern
id: 98961324-93cb-50df-8b95-1084e1753fff
status: experimental
description: 'Identifies web server / reverse proxy log entries indicating HTTP/2
  connections

  where streams are opened and then abruptly reset by the client (sc-status 400 or
  499,

  or connection aborted) shortly after the request, consistent with the HTTP/2 Rapid
  Reset

  denial-of-service technique (CVE-2023-44487). A single event is not conclusive;
  this

  behaviour becomes malicious when observed at high frequency (tens to thousands of

  resets per second) from the same client or small set of clients against one host,

  which should be validated with rate-based correlation in the SIEM rather than in
  this rule.

  '
references:
- https://www.ipa.go.jp/
- https://nvd.nist.gov/vuln/detail/CVE-2023-44487
author: Vorant
tags:
- attack.t1499
logsource:
  category: webserver
detection:
  selection:
    cs-version: HTTP/2.0
    sc-status:
    - 400
    - 499
  filter_healthcheck:
    cs-uri-stem|contains:
    - /health
    - /status
    - /ping
  condition: selection and not filter_healthcheck
falsepositives:
- Load balancer or monitoring health checks using HTTP/2 that legitimately close streams
  early
- Clients on unstable networks causing frequent HTTP/2 stream aborts
- Misconfigured HTTP/2 clients retried aggressively by legitimate applications
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/1011-ms.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1b9f0cc6-4fe6-544d-ae45-6b2b31c41e45/microsoft-patches-three-actively-exploited-flaws.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup