Flash Notice: Critical Outlook Vulnerability for Windows is Easy to Exploit

overview

A critical vulnerability was found in Microsoft Outlook for Windows. The vulnerability is being tracked as CVE-2023-23397 and could allow an attacker to remotely steal hashed passwords simply by sending a specially crafted email, the victim does not need to open or preview the email for the exploit to work.

Although the vulnerability, which has a CVSS score of 9.8, has been patched by Microsoft, it has been exploited as a zero-day vulnerability in NTLM-relay attacks since mid-April 2022. CVE-2023-23397 is a privilege escalation flaw that impacts all versions of Microsoft Outlook on Windows. By sending a malicious email, an attacker can steal NTLM credentials without any user interaction. Exploitation takes place when the system's reminder is triggered, and Outlook is open.

After reviewing a script from Microsoft, security researcher Dominic Chell proved that CVE-2023-23397 is easy to exploit. He discovered that the script could scan for the “PidLidReminderFileParameter” property in received email items and remove it if found. This property allows the sender to define the file name that the Outlook client should play when the message reminder is triggered.

Microsoft stated that an attacker can use the vulnerability to obtain NTLM hashes by sending a message that contains an extended MAPI property with a UNC path to an SMB (TCP 445) share on a server controlled by the threat actor.

Microsoft has provided documentation and a script for organizations that want to determine if they have been targeted by actors attempting to use the vulnerability. Due to the vulnerability being easy to exploit, it is highly recommended that organizations patch CVE-2023-23397 as soon as possible.

avertium's recommendations

• Avertium recommends that organizations update Microsoft Outlook for Windows as soon as possible. You may find patch guidance in Microsoft’s advisory.
• Keep in mind that while supported versions of Microsoft Outlook for Windows are impacted, other versions of Microsoft Outlook (Android, iOS, Mac, Outlook on the web, and other M365 services) are not impacted.

INDICATORS OF COMPROMISE (IoCs)

At this time, there are no known IoCs associated with CVE-2023-23397. Avertium’s threat hunters remain vigilant in locating IoCs for our customers. Should any be located, Avertium will disclose them as soon as possible. For more information on how Avertium can help protect your organization, please reach out to your Avertium Service Delivery Manager or Account Executive.

How Avertium is Protecting Our CUSTOMERS

• Fusion MXDR is the first MDR offering that fuse together all aspects of security operations into a living, breathing, threat-resistant XDR solution. By fusing insights from threat intelligence, security assessments, and vulnerability management into our MDR approach, Fusion MXDR offers a more informed, robust, and cost-effective approach to cybersecurity – one that is greater than the sum of its parts.
• Avertium offers Vulnerability Management to provide a deeper understanding and control over organizational information security risks. If your enterprise is facing challenges with the scope, resources, or skills required to implement a vulnerability management program with your team, outsourced solutions can help you bridge the gap.
• Avertium offers Zero Trust Network as a Service (ZTNaaS) for any organization that wants to control their attack surface. The zero-trust security model delivers exactly what the name promises: it is an IT security concept that specifies no access is allowed until the successful completion of authentication and authorization processes. 

SUPPORTING DOCUMENTATION