[Update] Vulnerability in Microsoft Outlook (February 15, 2024)

CERT-FR Alert Bulletin Subject: [Update] Vulnerability in Microsoft Outlook Document Management A detailed version history is available at the end of this document. Risks - Data confidentiality breach - Remote arbitrary code execution Affected Systems - Microsoft 365 Apps - Microsoft Office 2016 - Microsoft Office 2019 - Microsoft Office LTSC 2021 The vulnerability particularly affects Microsoft Outlook, which is included in the Microsoft Office suite. The OWA interface (Outlook Web Application), the web version of Outlook mail, is not affected by this vulnerability according to the vendor. Summary [Update March 15, 2024] Added clarification regarding NTLM challenge-response [Update February 22, 2024] Added recommendations and clarifications on how the vulnerability works. Vulnerability CVE-2024-21413 allows an attacker to bypass security measures in the Office suite, including the Outlook messaging solution. More specifically, its exploitation allows bypassing certain security measures in the Office suite that prevent access to an external resource without user validation. Thus, by using a malicious link in an email, an attacker is able to: - obtain the response to a challenge-response related to user authentication, for example via the SMB protocol. This challenge-response depends on system configuration and is commonly in NTLMv2 format. This behavior combined with an "NTLM relay" attack would allow an attacker to perform authentication coercion. - if the link's target is an Office document, cause the document to open without Microsoft Office Protected View being enabled, ultimately allowing for remote arbitrary code execution. [Initial Publication] On February 13, 2024, Microsoft published a patch for vulnerability CVE-2024-21413 affecting Outlook for Windows. It allows an unauthenticated attacker to disclose the local NTLM (new technology LAN manager) hash and potentially achieve remote arbitrary code execution. Its exploitation requires user interaction. A partial proof of concept and a description of the vulnerability were published by the researcher who discovered it. CERT-FR is not aware of any exploitation at this time. This alert may be updated depending on the evolution of the situation. Solution [Update March 15, 2024] Added clarification regarding NTLM challenge-response [Update February 22, 2024] Added recommendations. To prevent remote exploitation of this vulnerability, CERT-FR recommends: - Applying the update provided by Microsoft as soon as possible. Refer to the vendor's security bulletin for patches (see Documentation section). - Limiting the use of NTLMv2 and enabling protection against relay attacks recommended by the vendor [2] as well as recommendations (R71 to R77) related to secure administration of information systems based on Microsoft Active Directory [3]. - Disabling outbound SMB traffic from the information system (TCP/445). This rule also applies to mobile workstations, whose traffic must be secured. - Detecting malicious links in received emails, for example by using a regular expression (see Yara rule [1]). CERT-FR cannot guarantee the results obtained by this detection rule, which must therefore be qualified. [Initial Publication] CERT-FR strongly recommends applying the update provided by Microsoft. Refer to the vendor's security bulletin for patches (see Documentation section). Documentation - Microsoft Security Bulletin of February 13, 2024 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413 - [1] Yara rule for detecting vulnerability CVE-2024-21413 proposed by X__Junior and Florian Roth https://github.com/Neo23x0/signature-base/blob/master/yara/expl_outlook_cve_2024_21413.yar - [2] Microsoft Knowledge Base https://support.microsoft.com/fr-fr/topic/kb5005413-att%C3%A9nuation-des-attaques-de-relais-ntlm-sur-les-services-de-certificats-active-directory-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429 - [3] Recommendations for the secure administration of information systems based on Microsoft Active Directory. ANSSI-PA-099 document version 1.0 dated October 2, 2023 https://cyber.gouv.fr/publications/recommandations-pour-ladministration-securisee-des-si-reposant-sur-ad - CERTFR Advisory-2024-AVI-0127 of February 14, 2024 /avis/CERTFR-2024-AVI-0127/ - CVE Reference CVE-2024-21413 https://www.cve.org/CVERecord?id=CVE-2024-21413