A zero-click flaw in Windows allows stealing NTLM credentials
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-23397 | Zero-Click Elevation of Privilege in Microsoft Outlook (Forced NTLM Credential Leak) CVE-2023-23397 is an elevation of privilege vulnerability in Microsoft Outlook caused by improper input validation (CWE-20) combined with authentication bypass via spoofed authentication data on the channel (CWE-294), allowing an attacker to force Outlook to authenticate to an attacker-controlled SMB/WebDAV server. It is triggered when Outlook processes a crafted email or calendar object — for example a meeting or task reminder whose sound property points to an attacker-supplied UNC path — and requires no user interaction. That authentication exchange leaks the victim's NTLM credential hash, which the attacker can crack offline or relay to authenticate as the victim and access resources such as Exchange mailboxes, effectively escalating privileges. Affected software spans Microsoft 365 Apps, Microsoft Office (including the Long Term Servicing Channel), and Microsoft Outlook, which are deployed across enterprises, governments, and militaries worldwide. It is actively exploited in the wild — added to CISA's Known Exploited Vulnerabilities catalog on 2023-03-14 with a 97.4% EPSS — and Microsoft has warned of exploitation by Russia-aligned threat actors in campaigns against government and military mail servers, with patches shipped in Microsoft's March 2023 security updates. Do: Apply Microsoft's March 2023 security updates to Microsoft 365 Apps, Office/LTSC, and Outlook immediately, per CISA's required action. As interim mitigation, enable Extended Protection for Authentication or add accounts to the Protected Users group to block the NTLM credential leak, and audit calendar and task reminder sound properties for UNC paths (Microsoft published an audit/cleanup script for this) while watching for unexpected outbound SMB/WebDAV connections from hosts running Outlook. | 9.8 | 97% | KEV |
| masson the order of hundreds of millions of users (Outlook ships with Microsoft Office/Microsoft 365, the dominant enterprise and government email suite) | |
| CVE-2023-29324 | Windows MSHTML Platform Security Feature Bypass Vulnerability Windows MSHTML Platform Security Feature Bypass Vulnerability NVD description · AI analysis pending | 6.5 | 3% |
| — |
Full article389 words · extracted from securityaffairs.com · click to collapse
Researchers shared technical details about a flaw in Windows MSHTML platform, tracked as CVE-2023-29324, that could be abused to bypass security protections.
Cybersecurity researchers have shared details about a now-patched security flaw, tracked as CVE-2023-29324 (CVSS score: 6.5), in Windows MSHTML platform.
An attacker can exploit the vulnerability by crafting a malicious URL that would evade zone checks.
“An attacker can craft a malicious URL that would evade zone checks, resulting in a limited loss of integrity and availability of the victim machine” reads the advisory published by Microsoft.
This vulnerability affects all supported versions of Microsoft Windows, it was reported by the Security Researcher Ben Barnea from Akamai Technologies.
Microsoft addressed the vulnerability with the release of Patch Tuesday security updates for May 2023.
Barnea explained that the issue causes the Windows API function MapUrlToZone to incorrectly think that a remote path is a local one. The problem stems from the complex handling of paths in Windows.
MapUrlToZone calls the function CreateUri which incorrectly converts the path ‘\\.\UNC\\Akamai.com\file.wav’ to ‘/.//UNC//Akamai.com/file.wav’.
“MapUrlToZone is commonly used as a security measure. In particular, it was used to mitigate the critical Outlook vulnerability CVE-2023-23397 patched in the March Patch Tuesday.” reads the analysis published by Barnea. “An unauthenticated attacker on the internet could use the vulnerability to coerce an Outlook client to connect to an attacker-controlled server. This results in NTLM credentials theft. It is a zero-click vulnerability, meaning it can be triggered with no user interaction.”
Microsoft Threat Intelligence observed a Russian threat actor exploiting the CVE-2023-23397 flaw in targeted attacks against several organizations in the European government, transportation, energy, and military sectors, for approximately a year.
“This vulnerability is yet another example of patch scrutinizing leading to new vulnerabilities and bypasses. Specifically for this vulnerability, the addition of one character allows for a critical patch bypass.” concludes the expert.
We are in the final!
Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections where is reported Securityaffairs or my name Pierluigi Paganini
Please nominate Security Affairs as your favorite blog.
Nominate Pierluigi Paganini and Security Affairs here here: https://docs.google.com/forms/d/e/1FAIpQLSepvnj8b7QzMdLh7vWEDQDqohjBUsHyn3x3xRdYGCetwVy2DA/viewform
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Windows MSHTML)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/146061/security/zero-click-flaw-windows.html