Patch v1 for CVE-2023-36884

# Define the parameters for the script
[CmdletBinding()]
param (
    [Parameter()]
    [String]$OfficeProducts = "All",    # Office products to be targeted for remediation (default: "All" for all products)
    [Parameter()]
    [Switch]$Undo                       # Switch to indicate whether to undo the changes
)

begin {
    # Function to check if the script is running with administrator privileges
    function Test-IsElevated {
        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()
        $p = New-Object System.Security.Principal.WindowsPrincipal($id)
        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)
    }

    # Function to set a registry key with given parameters
    function Set-RegKey {
        param (
            $Path,
            $Name,
            $Value,
            [ValidateSet("DWord", "QWord", "String", "ExpandedString", "Binary", "MultiString", "Unknown")]
            $PropertyType = "DWord"
        )
        # Check if the registry path exists; if not, try to create it
        if (-not $(Test-Path -Path $Path)) {
            try {
                New-Item -Path $Path -Force -ErrorAction Stop | Out-Null
            }
            catch {
                Write-Error "[Error] Unable to create registry path $Path. Please run the script with administrator privileges."
                exit 1
            }
        }

        # Get the current value of the registry key
        $CurrentValue = (Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name

        try {
            # Set the registry key with the provided value
            Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force -Confirm:$false -ErrorAction Stop | Out-Null
        }
        catch {
            Write-Error "[Error] Unable to set registry key for $Name. Please see the error details below:"
            Write-Error $_.Exception.Message
            exit 1
        }

        # Display the change in the registry key
        Write-Host "$Path\$Name changed from $CurrentValue to $($(Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name)"
    }

    # Define the mapping of Office products to their corresponding registry values
    $RemediationValues = @{
        "Excel" = "Excel.exe"; "Graph" = "Graph.exe"; "Access" = "MSAccess.exe";
        "Publisher" = "MsPub.exe"; "PowerPoint" = "PowerPnt.exe"; "OldPowerPoint" = "PowerPoint.exe";
        "Visio" = "Visio.exe"; "Project" = "WinProj.exe"; "Word" = "WinWord.exe"; "Wordpad" = "Wordpad.exe"
    }
}

process {
    # Check if the script is running with administrator privileges
    if (-not (Test-IsElevated)) {
        Write-Error -Message "Access Denied. Please run the script with Administrator privileges."
        exit 1
    }

    # If specific office products are provided, filter the list to those products
    if ($OfficeProducts -notlike "All") {
        $OfficeProducts = $OfficeProducts.split(',') | ForEach-Object { $_.Trim() }
        $RemediationTargets = $RemediationValues.GetEnumerator() | ForEach-Object { $_ | Where-Object { $OfficeProducts -match $_.Key } }
    }
    else {
        $RemediationTargets = $RemediationValues.GetEnumerator()
    }

    # Define the path to the registry keys
    $Path = "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION"

    # Check if there are any products to remediate
    if ($RemediationTargets) {
        # For each product targeted for remediation, set the corresponding registry key
        $RemediationTargets | ForEach-Object {
            Write-Host "$($_.Name) was selected for remediation."
            if (-not $Undo) {
                # Apply the remediation by setting the registry key to 1
                Set-RegKey -Path $Path -Name $_.Value -Value 1
                Write-Host "Success!"
            }
            else {
                # Undo the remediation by removing the registry key
                Remove-ItemProperty -Path $Path -Name $_.Value -ErrorAction SilentlyContinue | Out-Null
                if (Get-ItemProperty -Path $Path -Name $_.Value -ErrorAction SilentlyContinue) {
                    Write-Error "[Error] Unable to undo registry key $($_.Value)!"
                    exit 1
                }
                else {
                    Write-Host "Successfully removed registry key!"
                }
            }
        }

        Write-Warning "A reboot may be required."
        exit 0
    }
    else {
        # No products were selected for remediation
        Write-Warning "No products were selected! The valid values for -OfficeProducts are listed below. You can also use a comma-separated list or simply put 'All'."
        $RemediationValues | Sort-Object Name | Format-Table | Out-String | Write-Host
        Write-Error "ERROR: Nothing to do!"
        exit 1
    }
}