Attacker Value
Very High
(2 users assessed)
Exploitability
Very High
(2 users assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Network
15

CVE-2023-23397

Disclosure Date: March 14, 2023
Exploited in the Wild
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Credential Access
Techniques
Validation
Validated
Initial Access
Techniques
Validation
Validated

Description

Microsoft Outlook Elevation of Privilege Vulnerability

Add Assessment

2
Ratings
Technical Analysis

Microsoft reported having been notified by Cert-UA of a zero-day vulnerability in Outlook. This vulnerability was observed to be used by nation-state actors targeting Ukraine’s government, military, energy, and transport sector during Mid-April and December 2022.

By sending malicious Outlook notes and tasks, the attackers were able to steal NTLM hashes via NTLM negotiation requests by forcing the targets’ devices to authenticate to attacker-controlled SMB shares. These obtained credentials were used for lateral movement within the victim’s networks.

Attackers are able to craft an email that contains an extended MAPI property called PidLidReminderFileParameter for either a calendar appointment, note or task. This property can contain a remote UNC path to an SMB (TCP port 445) share on a threat actor-controlled server. The malicious email does not require any user interaction and the vulnerability can be triggered without either reading the email or viewing the email in preview mode, the vulnerability will be triggered automatically when the Outlook client receives and processes the email. Upon processing the malicious email, Outlook will access the UNC path to the attacker-controlled SMB share, which allows an attacker to perform an NTLM relay attack and access other internal systems.

CVE-2023-23397 impacts all supported versions of Microsoft Outlook for Windows but doesn’t affect Outlook for Android, iOS, or macOS versions.
Outlook on the web and Microsoft 365 do not support NTLM authentication and are not vulnerable to CVE-2023-23397

CVSS V3 Severity and Metrics
Base Score:
9.8 Critical
Impact Score:
5.9
Exploitability Score:
3.9
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • microsoft

Products

  • 365 apps -,
  • office 2019,
  • office 2021,
  • outlook 2013,
  • outlook 2016

Exploited in the Wild

Reported by:

References

Additional Info

Technical Analysis

Description

CVE-2023-23397 is a zero-interaction vulnerability in Microsoft Outlook patched in the March 14, 2023 Patch Tuesday release. This vulnerability was reported to Microsoft as exploited in the wild by CERT-UA (Ukrainian CERT) which has strongly implied nation-state exploitation. Microsoft has released an advisory via MSRC. Although the vulnerability is technically an elevation of privilege (EoP) vulnerability, under certain conditions, the impact of this vulnerability is functionally equivalent to an authentication bypass.

Affected products include:

  • All versions of Microsoft Outlook for Windows are impacted.
  • Versions of Microsoft Outlook for Mac, iOS, Android, Outlook web access, and Microsoft 365 are not affected.

Technical analysis

Rapid7 analysts have corroborated MDSec’s analysis of the audit script provided by Microsoft. According to this analysis, the vulnerability results from the receipt of a crafted Outlook MSG file where the ”PidLidReminderFileParameter” – a message property that accepts a universal naming convention (UNC) path – is set to an attacker-controlled resource, such as an IP address.

By setting this parameter to an external IP, it will trigger NTLM authentication to this IP address whether or not the email has been viewed in the preview pane. That is, the connection to the attacker-controlled SMB server will send the user’s NTLM negotiation message, which allows an attacker to relay that message to authenticate against other systems that support NTLM authentication. In effect, this means that the receipt of a crafted MSG file can result in user impersonation against certain systems – essentially an authentication bypass.

Guidance

Microsoft Outlook users are encouraged to patch as soon as possible. Additionally, outbound connections on port 445 should be blocked by a firewall.

Adding users to the Protected Users Security Group will prevent the use of NTLM as an authentication mechanism, but may impact applications that require NTLM.

Microsoft has provided documentation and a script to determine if your organization was targeted by threat actors.

References