Microsoft Outlook CVE-2023-23397 Actively Exploited to Steal NTLM Credentials
Summary
Attackers exploited a Windows Outlook vulnerability by sending crafted messages that could expose NTLM hashes before they were viewed. Microsoft issued a patch; Talos recommends updating and provides detection rules.
Key points
- CVE-2023-23397 affects Microsoft Outlook on Windows; Outlook for Android, iOS, Mac, and the web is not affected.
- A crafted email, calendar invite, or task can trigger the flaw when Outlook processes it, even before the message is viewed.
- The attack can send a victim’s Net-NTLMv2 hash to an attacker-controlled SMB share, enabling potential NTLM relay attacks.
- Microsoft reported limited, targeted exploitation and associated the activity with Russian-based actors.
- Microsoft released a patch; Talos advises installing it promptly. If patching is not possible, suggested mitigations include restricting NTLM use and blocking outbound TCP/445.
- Talos provided Snort rules and a ClamAV signature to help detect exploitation. Microsoft also released a script to audit Exchange messaging items for the relevant UNC-path property.
Article Details
- Vulnerability Types
- Privilege escalation via NTLM credential theft
- Severity
- Critical
- Affected Versions
- All Microsoft Outlook products on Windows; non-Windows versions and Outlook on the web are not affected
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Add users to the Protected Users Security Group to prevent NTLM authentication.
- Block outbound TCP/445 to prevent NTLM messages from leaving the network.
CVE
People
Vendors
Products
Adaptive Security ApplianceCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.Cisco Secure EndpointIf the ESA Administrator would prefer to rely on Cisco Secure Endpoint + Secure Malware Analytics integration to avoid performance impacts that option is also available.Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco Secure Firewall Management CenterActive exploitation of Cisco Secure Firewall Management Center vulnerabilitiesCisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Cisco Secure Network/Cloud AnalyticsCisco Secure Network/Cloud Analytics (Stealthwatch/Stealthwatch Cloud) analyzes network traffic automatically and alerts users of potentially unwanted activity on every connected device.Cisco Secure Web ApplianceCisco Secure Web Appliance (formerly Web Security Appliance) automatically blocks potentially dangerous sites and tests suspicious sites before users access them.ClamAVFirst, we are providing a ClamAV signature that detects this threat — the rule can be found on our GitHub here and can be leveraged anywhere ClamAV signatures are supported.Meraki MXCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Microsoft 365 Apps for Enterpriseversions of Outlook such as apps for Android, iOS, Mac, as well as Outlook on the web and other Microsoft 365 services. However, the CVSS attack complexity is rated “Low”. An attacker can exploit thisMicrosoft Exchange ServerMicrosoft also released a script intended to help administrators audit their Exchange server for messaging items (mail, calendar and tasks) that have a PidLidReminderFileParameter property populated with a UniversalMicrosoft OutlookThreat Advisory: Microsoft Outlook privilege escalation vulnerability being exploited in the wildSnortUsers should implement the patch as soon as possible. Additionally, Talos has released Snort rules 61478 and 61479, and Snort 3 signature 300464 to detect the exploitation of this vulnerability.StealthwatchCisco Secure Network/Cloud Analytics (Stealthwatch/Stealthwatch Cloud) analyzes network traffic automatically and alerts users of potentially unwanted activity on every connected device.Stealthwatch CloudCisco Secure Network/Cloud Analytics (Stealthwatch/Stealthwatch Cloud) analyzes network traffic automatically and alerts users of potentially unwanted activity on every connected device.Threat Defense VirtualCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Threat GridCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.UmbrellaUmbrella, Cisco’s secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.Web Security ApplianceCisco Secure Web Appliance (formerly Web Security Appliance) automatically blocks potentially dangerous sites and tests suspicious sites before users access them.