Critical Vulnerability in Outlook Requiring Little to No Interaction Patched by Microsoft

Critical Vulnerability in Outlook Requiring Little to No Interaction Patched by Microsoft

Mar 15, 2023 | Critical Alert, Enterprise Threat Intelligence, Threat Intelligence Brief

Read our latest Enterprise Threat Intelligence Briefing on the Microsoft Outlook Elevation of Privilege Vulnerability, compiled by Kyle Nordby and John Garner.

Vulnerability

CVE-2023-23397 – Microsoft Outlook Elevation of Privilege Vulnerability[1]

Affected Products

All supported versions of Microsoft Outlook for Windows

Remediation

  • March 14th security patches for Microsoft Outlook[1]
  • Mitigations against Pass-the-Hash attacks[2]
  • Block outbound SMB traffic at the firewall

Detection

  • Microsoft PowerShell detection script[3]
  • Suspicious outbound SMB traffic

Microsoft released a patch in February regarding a vulnerability with a CVSS score of 9.8, just shy of the maximum of 10. This low-complexity exploit was found and reported to Microsoft by the Ukrainian Computer Emergency Response Team (CERT).

While the Microsoft Security Response Center (MSRC) page[1] states that there is no currently released proof-of-concept (POC) code, security researchers have already figured out how to leverage this exploit. For example, in an article by MDSec on the same day as the announcement[4], a red teamer built a full POC detailing how the exploit works.

This was originally seen being leveraged by Russian threat actors as early as April 2022. With the publicity of the CVE and ease of exploitation, PacketWatch has high confidence that this will be actively exploited in the coming weeks. PacketWatch already monitors for indicators of compromise (IOCs) by checking for suspicious outbound SMB traffic and is currently advising to both patch Outlook and review firewall policies for current clients.

In emails with tasks or calendar events that have due dates, the sender can specify when it becomes overdue, playing a default or custom sound. The exploit itself relies on that property, where the attacker instead replaces the reminder sound with a malicious UNC path[5]. This triggers the Outlook client to send NTLM hashes over SMB to a destination controlled by the attacker. Once completed, the attacker can then leverage those credentials using an NTLM Relay attack, also known as a Pass-the-Hash attack[6].

A patch for affected Outlook clients is already available by Microsoft[1]. Proactively, PacketWatch recommends reviewing what protocols and ports can communicate externally to the environment. Microsoft has also released a detection script that can reveal previous exploitation attempts[3].

References

CISA Adds Additional VMware Security Flaw to Known Exploited Vulnerabilities Catalog

CISA Adds Additional VMware Security Flaw to Known Exploited Vulnerabilities Catalog

Mar 10, 2023 | Critical Alert, Enterprise Threat Intelligence

THREAT ACTORS LEVERAGING EXPLOITS SEEN IN WILD SINCE DECEMBER

CVE-2021-39144 – VMware Cloud Foundation XStream Remote Code Execution Vulnerability

The Cybersecurity and Infrastructure Security Agency (CISA) has added another VMware vulnerability (CVE-2021-39144) to their growing list of vulnerabilities that they have observed threat actors exploiting in the wild. Exploitation only requires network access to the NSX-v Manager appliance, and successful exploitation will give root privileges (full control) of the NSX-v Manager. This exploit is lower complexity with available POC code, and vulnerable systems only need to be network accessible to any compromised machines, or web accessible, with no additional requirements such as valid credentials.

All versions of VMware NSX Data Center for vSphere (NSX-v) Manager 6.4.14 are affected by the vulnerability. Because these are observed being actively exploited, it is important to ensure that relevant VMware products are fully patched. Additional information is available in the VMware article linked below. Proof of concept (POC) code is currently available, giving both security professionals and threat actors easy methods to find vulnerable systems. The NIST link below has references to available exploit code.

Mitigation

  • If leveraging VMware Cloud Foundation, ensure that it is fully patched.
  • Proper documentation of critical and sensitive infrastructure products to quickly identify potentially vulnerable systems.
  • Network segmentation and limited accessibility to VMware/critical infrastructure should be enforced and periodically reviewed.

More Info

https://www.cisa.gov/news-events/alerts/2023/03/10/cisa-adds-two-known-exploited-vulnerabilities-catalog
https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-vmware-rce-flaw-exploited-in-attacks
https://www.vmware.com/security/advisories/VMSA-2022-0027.html
https://nvd.nist.gov/vuln/detail/CVE-2021-39144

Disclaimer

The information provided in this article is provided “as-is”. It is not finally evaluated intelligence and should be considered raw information that is provided for strictly situational awareness, given what is known at this time.