Latest News! Critical Microsoft Outlook Zero-Day Vulnerability Patched

Recently, Microsoft patched an Outlook zero-day vulnerability (CVE-2023-23397) that was exploited by a Russian-linked hacking group to target European organisations.

According to the tracking and analysis by Lexfo Security Labs, between mid-April and December 2022, this security vulnerability was used to attack and compromise the networks of approximately 15 government, military, energy, and transportation organisations.

The hacking group (known as APT28, STRONTIUM, Sednit, Sofacy, and Fancy Bear) stole NTLM hashes by sending malicious Outlook notes and tasks through NTLM negotiation requests, forcing target devices to authenticate to an SMB share controlled by the attackers.

The stolen credentials were used for lateral movement within the victim's network and to change Outlook mailbox folder permissions, a mail exfiltration strategy allowing access to specific accounts.

Microsoft shared this information in a threat intelligence report available to customers subscribed to Microsoft 365 Defender, Microsoft Defender for Business, or Microsoft Defender for Endpoint Plan 2.

▍Critical EoP in Outlook for Windows

The vulnerability (CVE-2023-23397), reported by CERT-UA (Computer Emergency Response Team of Ukraine), is a significant Outlook Elevation of Privilege (EoP) security vulnerability that can be exploited in low-complexity attacks without user interaction.

Attackers can exploit this vulnerability by sending messages with extended MAPI properties containing UNC paths pointing to an SMB share (TCP 445) under their control.

Microsoft stated in a recently released security advisory: "An attacker could exploit this vulnerability by sending a specially crafted email which triggers automatically when it is retrieved and processed by the Outlook client. This could lead to exploitation before the email is viewed in the Preview Pane."

Analysis by Lexfo Security Labs found: "The connection to the remote SMB server sends the user's NTLM negotiation message, which the attacker can then forward to authenticate against other systems that support NTLM authentication."

CVE-2023-23397 affects all supported versions of Outlook for Windows, but does not affect Android, iOS, or macOS versions.

Additionally, online services such as Outlook on the web and Microsoft 365 are not vulnerable to attacks exploiting this NTLM relay vulnerability because they do not support NTLM authentication.

Microsoft recommends patching CVE-2023-23397 immediately to mitigate this vulnerability and block any incoming attacks.

They also suggest adding users to the "Protected Users" group in Active Directory and blocking outbound SMB (TCP port 445) if patching is not immediately possible, which may limit the impact of CVE-2023-23397 to some extent.

▍Mitigation and Target Detection Script Provided

Microsoft urges customers to patch their systems against CVE-2023-23397 immediately or add users to the Protected Users group in Active Directory and block outbound SMB (TCP port 445) as a temporary mitigation measure to minimise the impact of attacks.

Lexfo Security Labs has observed the release of a dedicated PowerShell script to help administrators check if users in their Exchange environment are being targeted using this Outlook vulnerability.

Microsoft stated that this script can "check Exchange mail items (mail, calendar, and tasks) to see if properties are populated with UNC paths".

If necessary, administrators can use this script to clear properties of malicious items or even permanently delete these items.

This script also allows modification or deletion of potentially malicious emails if found on the audited Exchange Server when run in cleanup mode.

Lexfo Validation advises organisations to remain vigilant regarding this vulnerability. Lexfo Security Labs has included the POC for this exploit to help users properly respond to potential attacks.

Currently, the Lexfo Security Metrics Validation Platform is already capable of simulating attacks targeting this vulnerability. By searching for the keyword "CVE-2023-23397" within the platform, you can access relevant attack simulation experiments to easily verify whether your current security protection methods or mitigation measures can effectively detect and defend against attacks exploiting this vulnerability.