Full Report
Microsoft Outlook Elevation of Privilege Vulnerability
Analysis Summary
# Vulnerability: Microsoft Outlook NTLM Relay Elevation of Privilege
## CVE Details
- **CVE ID:** CVE-2023-23397
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-294 (Authentication Bypass by Capture-replay) / CWE-20 (Improper Input Validation)
## Affected Systems
- **Products:** Microsoft Outlook for Windows.
- **Versions:** Multiple versions across Office 365 Apps, Office 2013, 2016, and 2019 (LTSC). Note: Outlook for Android, iOS, and macOS are **not** affected.
- **Configurations:** Systems where NTLM authentication is enabled and outbound SMB (TCP 445) is permitted.
## Vulnerability Description
This is a critical elevation of privilege flaw that occurs when a specially crafted email is processed by the Outlook client. The vulnerability is triggered when the client receives a message with a modified MAPI property (`PidLidReminderFileParameter`) that points to a Universal Naming Convention (UNC) path on an attacker-controlled SMB share.
Crucially, the exploit is **zero-click**; the victim does not need to open or interact with the email. When the reminder is triggered, the Outlook client automatically attempts to authenticate with the remote SMB server, leaking the user's NTLM hash (Net-NTLMv2) to the attacker. The attacker can then perform a relay attack to authenticate as the victim on other services.
## Exploitation
- **Status:** Exploited in the wild (attributed to nation-state actor APT28/Fancy Bear).
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Theft of NTLM hashes allows access to sensitive data).
- **Integrity:** High (Ability to impersonate users and perform actions on their behalf).
- **Availability:** High (Potential for account lockout or service disruption during relay).
## Remediation
### Patches
- Apply security updates released by Microsoft in March 2023. Reference the MSRC update guide: `https[:]//msrc[.]microsoft[.]com/update-guide/vulnerability/CVE-2023-23397`
### Workarounds
- **Add users to the "Protected Users" Security Group:** This prevents NTLM from being used as an authentication mechanism.
- **Block Outbound SMB:** Restrict TCP port 445 at the perimeter firewall to prevent NTLM authentication messages from leaving the internal network to remote internet-based file shares.
## Detection
- **Indicators of Compromise:** Monitoring for outbound connections to suspicious or unknown IP addresses over port 445. (Example IP linked to APT28: `113[.]160[.]234[.]229`).
- **Detection Methods:**
- Use the Microsoft-provided PowerShell script to scan Exchange items (emails, calendar entries, and tasks) for the presence of the `PidLidReminderFileParameter` property pointing to external UNC paths.
- Security solutions (e.g., Business Email Protection) can be configured to block emails containing malicious MAPI property payloads.
## References
- Microsoft Security Advisory: `https[:]//msrc[.]microsoft[.]com/update-guide/vulnerability/CVE-2023-23397`
- Group-IB Blog: `https[:]//www[.]group-ib[.]com/blog/cve-2023-23397-outlook-vulnerability/`