CVE-2023-23397

Published Mar 14, 2023

Last updated 8 months ago

Smb

Overview

AI description

Automated description summarized from trusted sources.

CVE-2023-23397 is an elevation of privilege vulnerability affecting Microsoft Outlook for Windows. This flaw allows a threat actor to exploit the system by sending a specially crafted email, calendar invitation, or task item. The vulnerability is particularly notable because it requires no user interaction; the exploit can be triggered automatically when the malicious item is processed by the Outlook client, even before it is opened or previewed. The mechanism behind the vulnerability involves a custom Messaging Application Programming Interface (MAPI) property, specifically `PidLidReminderFileParameter`, within the malicious message. This property, intended for specifying a custom reminder sound file, is set to a Universal Naming Convention (UNC) path pointing to an attacker-controlled Server Message Block (SMB) server. When Outlook attempts to retrieve this "sound file," it inadvertently initiates an NTLM authentication session with the attacker's server, thereby leaking the victim's NTLM authentication hashes. These stolen hashes can then be used for NTLM relay attacks or offline password cracking.

Description: Microsoft Outlook Elevation of Privilege Vulnerability
Source: secure@microsoft.com
NVD status: Modified
Products: 365_apps, office, office_long_term_servicing_channel, outlook

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Microsoft Office Outlook Privilege Escalation Vulnerability
Exploit added on: Mar 14, 2023
Exploit action due: Apr 4, 2023
Required action: Apply updates per vendor instructions.

Weaknesses

secure@microsoft.com: CWE-20
nvd@nist.gov: CWE-294

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "40C15EDD-98D4-4D06-BA06-21AE0F33C72D",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*",
            "matchCriteriaId": "FF177984-A906-43FA-BF60-298133FBBD6B",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:*:*",
            "matchCriteriaId": "0B3EF1E5-4757-4CFA-AE72-6BA876D3C9FD",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:-:*:*:*",
            "matchCriteriaId": "8D513A61-6427-4F85-AADF-99D6F223AF2B",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:rt:*:*:*",
            "matchCriteriaId": "DDA98A76-D0D1-4BFA-BEAC-1C2313F7B859",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*",
            "matchCriteriaId": "E2B1657C-0FF4-461A-BE2A-641275C4B0A0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.