CVE-2024-21413

Published Feb 13, 2024

Last updated 2 months ago

Microsoft Outlook

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-21413 is a remote code execution (RCE) vulnerability affecting Microsoft Outlook. It stems from improper input validation when Outlook processes URLs, particularly those using the `file://` protocol and crafted URL structures. This vulnerability, also known as the "MonikerLink" bug, allows attackers to bypass security protections, such as the Office Protected View, and execute arbitrary code on a victim's machine by sending a malicious email. The vulnerability can be triggered even when previewing a maliciously crafted email. Successful exploitation could lead to remote code execution, theft of NTLM credentials, data exfiltration, data encryption, installation of malware, and potential full system compromise. It affects various versions of Microsoft Outlook, including Microsoft Office 2016, 2019, 2021, and Microsoft 365 Apps.

Description: Microsoft Outlook Remote Code Execution Vulnerability
Source: secure@microsoft.com
NVD status: Analyzed
Products: 365_apps, office_2016, office_2019, office_long_term_servicing_channel

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Microsoft Outlook Improper Input Validation Vulnerability
Exploit added on: Feb 6, 2025
Exploit action due: Feb 27, 2025
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

secure@microsoft.com: CWE-20
nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "40C15EDD-98D4-4D06-BA06-21AE0F33C72D"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_2016:-:*:*:*:-:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "45A9ECE7-F173-47AB-A420-0B6F64A04D21"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_2016:-:*:*:*:-:*:x86:*",
            "vulnerable": true,
            "matchCriteriaId": "BF3B9F15-3077-4BC5-9EC5-7416A9FBDC70"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "241CDE2B-ABD0-4EFF-8D73-1766E32FA20F"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x86:*",
            "vulnerable": true,
            "matchCriteriaId": "14D63E3F-A431-4DD8-979F-811E8DAC423D"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0B3EF1E5-4757-4CFA-AE72-6BA876D3C9FD"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.