Patch v3 for CVE-2023-36884

# Usage example

# Enable Protected View for Word: Toggle-FeatureForApplication -Enable `$true -Feature "ProtectedView" -Application "Word"

# Disable Protected View for All Applications: Toggle-FeatureForApplication -Enable `$false -Feature "ProtectedView" -Application "All"

# Toggle-ActiveXControlsInIE -Enable $true

# Toggle-ActiveXControlsInOffice -Enable $false

# Toggle-CrossProtocolNavigationInIE -Enable $true

# Toggle-ProtectedViewInOffice -Enable $false

# Define the parameters for the script
[CmdletBinding()]
param (
    [Parameter()]
    [ValidateSet("Word", "Excel", "PowerPoint", "Outlook", "OneNote", "Access", "Publisher", "Visio", "Project", "All")]
    [String]$OfficeProducts = "All",    # Office products to be targeted for remediation
    [Parameter()]
    [Switch]$Undo                       # Switch to indicate whether to undo the changes
)

# Function to check if the script is running with administrator privileges
function Test-IsElevated {
    $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()
    $p = New-Object System.Security.Principal.WindowsPrincipal($id)
    $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)
}

# Function to set a registry key with given parameters
function Set-RegKey {
    param (
        $Path,
        $Name,
        $Value,
        [ValidateSet("DWord", "QWord", "String", "ExpandedString", "Binary", "MultiString", "Unknown")]
        $PropertyType = "DWord"
    )
    # Check if the registry path exists; if not, try to create it
    if (-not $(Test-Path -Path $Path)) {
        try {
            New-Item -Path $Path -Force -ErrorAction Stop | Out-Null
        }
        catch {
            Write-Error "[Error] Unable to create registry path $Path. Please run the script with administrator privileges."
            exit 1
        }
    }

    # Get the current value of the registry key
    $CurrentValue = (Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name

    try {
        # Set the registry key with the provided value
        Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force -Confirm:$false -ErrorAction Stop | Out-Null
    }
    catch {
        Write-Error "[Error] Unable to set registry key for $Name. Please see the error details below:"
        Write-Error $_.Exception.Message
        exit 1
    }

    # Display the change in the registry key
    Write-Host "$Path\$Name changed from $CurrentValue to $Value"
}

# Function to remove registry key
function Remove-RegKey {
    param (
        $Path,
        $Name
    )

    # Remove the registry key
    Remove-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue | Out-Null
    if (Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue) {
        Write-Error "[Error] Unable to undo registry key $Name!"
        exit 1
    }
    else {
        Write-Host "Successfully removed registry key $Name!"
    }
}

# Function to perform remediation for specified products
function Perform-Remediation {
    param (
        [HashTable]$RemediationTargets,
        [Switch]$Undo
    )

    # Define the path to the registry keys
    $Path = "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION"

    # For each product targeted for remediation, set the corresponding registry key
    $RemediationTargets.GetEnumerator() | ForEach-Object {
        Write-Host "$($_.Name) was selected for remediation."
        if (-not $Undo) {
            # Apply the remediation by setting the registry key to 1
            Set-RegKey -Path $Path -Name $_.Value -Value 1
            Write-Host "Success!"
        }
        else {
            # Undo the remediation by removing the registry key
            Remove-RegKey -Path $Path -Name $_.Value
        }
    }

    Write-Warning "A reboot may be required."
}

# Main function
begin {
    # Check if the script is running with administrator privileges
    if (-not (Test-IsElevated)) {
        Write-Error "Please run the script with administrator privileges."
        exit 1
    }

    # Define the remediation targets based on the selected Office products
    $RemediationValues = @{
        "Word" = "WINWORD.EXE";
        "Excel" = "EXCEL.EXE";
        "PowerPoint" = "POWERPNT.EXE";
        "Outlook" = "OUTLOOK.EXE";
        "OneNote" = "ONENOTE.EXE";
        "Access" = "MSACCESS.EXE";
        "Publisher" = "MSPUB.EXE";
        "Visio" = "VISIO.EXE";
        "Project" = "WINPROJ.EXE";
        "All" = "All Products"
    }

    $RemediationTargets = @{}
    if ($OfficeProducts -ne "All") {
        $OfficeProducts = $OfficeProducts.split(',') | ForEach-Object { $_.Trim() }
        $RemediationTargets = $RemediationValues.GetEnumerator() | Where-Object { $OfficeProducts -contains $_.Key }
    }
    else {
        $RemediationTargets = $RemediationValues.GetEnumerator()
    }

    # Check if there are any products to remediate
    if ($RemediationTargets) {
        Perform-Remediation -RemediationTargets $RemediationTargets -Undo:$Undo
        exit 0
    }
    else {
        # No products were selected for remediation
        Write-Warning "No products were selected! The valid values for -OfficeProducts are listed below. You can also use a comma-separated list or simply put 'All'."
        $RemediationValues | Sort-Object Name | Format-Table | Out-String | Write-Host
        Write-Error "ERROR: Nothing to do!"
        exit 1
    }
}

function Toggle-ActiveXControlsInIE ($Enable) {
    $value = if ($Enable) { 0 } else { 1 }
    $path = "Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Ext"
    Set-RegKey -Path $path -Name "VersionCheckEnabled" -Value $value
}

function Toggle-ActiveXControlsInOffice ($Enable) {
    $value = if ($Enable) { 1 } else { 0 }
    $path = "Registry::HKEY_CURRENT_USER\Software\Microsoft\Office\Common\Security"
    Set-RegKey -Path $path -Name "UFIControls" -Value $value
}

function Toggle-CrossProtocolNavigationInIE ($Enable) {
    $value = if ($Enable) { 1 } else { 0 }
    $path = "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION"
    Set-RegKey -Path $path -Name "*" -Value $value
}

function Toggle-ProtectedViewInOffice ($Enable) {
    $value = if ($Enable) { 0 } else { 1 }
    $path = "Registry::HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\<OfficeProduct>\Security\ProtectedView"
    Set-RegKey -Path $path -Name "Enable" -Value $value
}

function Toggle-FeatureForApplication ($Enable, $Application, $Feature) {
    $value = if ($Enable) { 0 } else { 1 }
    $path = "Registry::HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\<OfficeProduct>\Security\$Feature"
    Set-RegKey -Path $path -Name $Application -Value $value
}