CVE-2023-23397 Lets Malicious Outlook Invitations Trigger NTLM Hash Exposure
Summary
Huntress explains how malicious Outlook calendar invitations could trigger NTLM hash exposure without being opened, describes observed process artifacts, and recommends patching. Microsoft’s patch was available; turning off Outlook reminders was also reported to prevent
Key points
- The vulnerability affected supported Windows versions of locally installed Outlook; Outlook for Android, iOS, Mac, and the web was reported unaffected.
- A malicious calendar invitation could use MAPI properties to specify a remote reminder sound, triggering an outbound connection and NTLM authentication without the recipient opening the email.
- Exposed Net-NTLMv2 hashes could potentially be used to authenticate as victims, escalate privileges, or support further compromise.
- Huntress observed svchost.exe spawning rundll32.exe with davclnt.dll during exploitation; the process artifacts varied depending on the available SMB or WebDAV service.
- Microsoft released security updates to address the vulnerability. Huntress recommended patching and described outbound SMB blocking and Protected Users membership as possible mitigations.
- Huntress reported that disabling Outlook’s “Show reminders” setting prevented credential leakage in its testing; researchers also reported a possible local-hostname privilege-escalation path after patching.
Article Details
- Vulnerability Types
- NTLM credential hash leak triggered by a malicious Outlook email without user interaction
- Severity
- Critical
- Affected Versions
- Microsoft Outlook for Windows: all supported versions, including locally installed Outlook from M365
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Turn off Outlook's "Show reminders" setting; the article reports that testing prevented NTLM credential leakage.
- Add users to the Protected Users Security Group to prevent NTLM authentication; Microsoft recommends this only as a temporary mitigation because it may affect other applications.
- Block outbound TCP 445/SMB traffic at network edges or local firewalls to prevent NTLM authentication to external file shares.
MITRE ATT&CK
T1059.001 · PowerShellA standalone PowerShell proof-of-concept was released, and Microsoft provided a PowerShell script to hunt for affected mail items.T1110.002 · Password CrackingThe article demonstrates offline cracking of captured hashes with John the Ripper.T1187 · Forced AuthenticationA crafted calendar invitation causes Outlook to initiate NTLM authentication to a host specified through a remote UNC resource, exposing Net-NTLMv2 hashes.T1557.001 · Name Resolution Poisoning and SMB RelayThe article describes captured NTLM hashes being usable in pass-the-hash attacks.
CVE
People
Dominic ChellPublished an early writeup and exploitation process, and reported that the vulnerability could still be used for privilege escalation after patching when triggered via a local hostname.Greg AkeHuntress detection engineer and threat hunter who shared a Sigma rule for detecting relevant WebDAV requests.John HammondHuntress security researcher who recreated the proof of concept and authored the article.Justin ElzeSuggested testing with the MsgKit C# library.Oddvar MoeReleased a standalone PowerShell proof of concept.Will DormannReported that turning off Outlook's "Show reminders" setting prevented NTLM credential leakage in testing and examined malicious invites.
Vendors
Products
M365versions of Microsoft Outlook for Windows are impacted to include the locally installed Outlook from M365. Other versions of Microsoft Outlook such as Android, iOS, Mac as well as Outlook on the web and otherMicrosoft OutlookHuntress has been tracking CVE-2023-23397, a critical vulnerability/0-day that impacts Microsoft Outlook. Unlike other exploits we’ve seen in the past, this exploit is particularly dangerous because no user interactionMicrosoft Windowsand your environments from this dangerous exploit. All supported versions of Microsoft Outlook for Windows are impacted to include the locally installed Outlook from M365. Other versions of Microsoft Outlook such
Tools
John the Ripperfurther post-exploitation. As an example, view this short demonstration of cracking the hashes with John the Ripper:MsgKitJustin Elze of TrustedSec suggests testing with the use of the C# library MsgKitResponderACE Responder suggests detection efforts to help hunt for exploitationwsgidavWhen we are not using Responder and there is no present SMB server, but only a WebDAV server (simple wsgidav for testing), there are consistent and multiple rundll32.exe artifacts.