CVE-2023-23397:

Microsoft Outlook Elevation of Privilege Vulnerability (CVE-2023-23397) allows attackers to steal NTLM hashes through specially crafted emails.

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.8Critical

Published Date:Mar 14, 2023
CISA KEV Date:Mar 14, 2023
Industries Affected:20

Threat Predictions

EPSS Score:93.4
EPSS Percentile:100%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Microsoft Outlook Elevation of Privilege Vulnerability (CVE-2023-23397) allows attackers to steal NTLM hashes through specially crafted emails.

Overview

This vulnerability affects Microsoft Outlook for Windows and stems from how Outlook processes certain message properties. When an attacker sends a specially crafted email that includes a UNC path to a remote SMB server they control, Outlook will automatically attempt to authenticate to that server using the user's Windows credentials. This occurs because the vulnerability triggers the NTLM authentication protocol, which sends the user's hashed credentials to the remote server. The attack is particularly dangerous because: 1. It requires no user interaction beyond receiving the email 2. It works even in the preview pane 3. It can be exploited before the email is viewed by the user 4. It allows attackers to capture authentication credentials remotely 5. The stolen NTLM hashes can be used in pass-the-hash attacks or cracked to reveal passwords

Remediation

To address this vulnerability, organizations should:
1. Apply Microsoft's security update immediately (released March 2023)
2. Use Microsoft's provided PowerShell script to scan for potentially malicious messages in Exchange mailboxes
3. Block outbound SMB (TCP ports 445 and 139) at the network perimeter to prevent NTLM authentication to external servers
4. Implement Extended Protection for Authentication and certificate-based authentication where possible
5. Enable Windows Defender Credential Guard to protect NTLM credentials
6. Consider disabling NTLM authentication if feasible in your environment
7. Implement multi-factor authentication to mitigate the impact of credential theft
8. Monitor for suspicious authentication attempts and network connections to external SMB servers