Full Report
Huntress is tracking CVE-2023-23397, a 0-day that impacts Microsoft Outlook and requires no user interaction to expose user credential hashes.
Analysis Summary
# Vulnerability: Microsoft Outlook Zero-Click NTLM Credential Theft
## CVE Details
- **CVE ID:** CVE-2023-23397
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-294 (Authentication Bypass by Capture-replay) / Elevation of Privilege
## Affected Systems
- **Products:** Microsoft Outlook for Windows.
- **Versions:** All supported versions of the locally installed Outlook desktop application (including Outlook from M365).
- **Configurations:** The vulnerability is triggered regardless of where the email is hosted (Exchange Online or on-premises); it relies specifically on the client application (`Outlook.exe`).
- **Note:** Outlook for Android, iOS, Mac, and Outlook on the Web (OWA) are **not** affected.
## Vulnerability Description
This is a critical elevation of privilege vulnerability that occurs when a specially crafted email with a malicious calendar invite or appointment arrives in a user's inbox. The exploit leverages MAPI properties (specifically related to custom reminder sounds) to force the Outlook client to connect to an attacker-controlled UNC path via SMB. This process automatically leaks the user’s Net-NTLMv2 hashes to the attacker.
## Exploitation
- **Status:** Exploited in the wild (0-day). Multiple Public PoCs available (C# and PowerShell).
- **Complexity:** Low (Zero-click; no user interaction is required to trigger the exploit).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Theft of sensitive NTLM credential hashes).
- **Integrity:** High (Enables NTLM relay attacks and unauthorized authentication).
- **Availability:** Low (Primary impact is credential theft and lateral movement).
## Remediation
### Patches
- Microsoft released security updates on March 14, 2023. Users should immediately update their Microsoft Office/Outlook installations to the latest version via the [Microsoft MSRC Update Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397).
### Workarounds
- **Disable Outlook Reminders:** Turning off the "Show reminders" setting in Outlook has been shown to prevent the leak of NTLM credentials.
- **Block Outbound SMB:** Block outbound TCP port 445 (SMB) from the network to the internet to prevent hashes from being sent to external attacker-controlled servers.
- **Add Users to Protected Users Group:** Adding high-value accounts to the "Protected Users" group in Active Directory can prevent the use of NTLM as an authentication mechanism.
## Detection
- **Indicators of Compromise:** Use the Microsoft-provided PowerShell script to scan Exchange items (tasks, email, and calendar events) for the presence of the `PidLidReminderFileParameter` property pointing to suspicious UNC paths.
- **Detection methods and tools:**
- **YARA:** Rules are available to scan `.msg` files for malicious calendar invitations.
- **Network Monitoring:** Monitor for unexpected outbound SMB traffic (Port 445) originating from workstations.
## References
- **Vendor Advisory:** hxxps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397
- **MSRC Mitigation Guide:** hxxps://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/
- **Huntress Analysis:** hxxps://www.huntress.com/blog/everything-we-know-about-cve-2023-23397
- **Public PoC (PowerShell):** hxxps://github.com/api0cradle/CVE-2023-23397-POC-Powershell