^{CVE-2023-23397:}Microsoft Outlook Elevation of Privilege Vulnerability (CVE-2023-23397) allows attackers to steal NTLM hashes through specially crafted emails.

Overview

This vulnerability affects Microsoft Outlook for Windows and stems from how Outlook processes certain message properties. When an attacker sends a specially crafted email that includes a UNC path to a remote SMB server they control, Outlook will automatically attempt to authenticate to that server using the user's Windows credentials. This occurs because the vulnerability triggers the NTLM authentication protocol, which sends the user's hashed credentials to the remote server. The attack is particularly dangerous because:

1. It requires no user interaction beyond receiving the email
2. It works even in the preview pane
3. It can be exploited before the email is viewed by the user
4. It allows attackers to capture authentication credentials remotely
5. The stolen NTLM hashes can be used in pass-the-hash attacks or cracked to reveal passwords

Remediation

To address this vulnerability, organizations should:

1. Apply Microsoft's security update immediately (released March 2023)
2. Use Microsoft's provided PowerShell script to scan for potentially malicious messages in Exchange mailboxes
3. Block outbound SMB (TCP ports 445 and 139) at the network perimeter to prevent NTLM authentication to external servers
4. Implement Extended Protection for Authentication and certificate-based authentication where possible
5. Enable Windows Defender Credential Guard to protect NTLM credentials
6. Consider disabling NTLM authentication if feasible in your environment
7. Implement multi-factor authentication to mitigate the impact of credential theft
8. Monitor for suspicious authentication attempts and network connections to external SMB servers

References

1. Microsoft Security Response Center: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397
2. Microsoft Security Blog on CVE-2023-23397: https://www.microsoft.com/security/blog/2023/03/14/guidance-for-investigating-attacks-using-cve-2023-23397/
3. CISA Advisory on CVE-2023-23397: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a
4. MITRE CWE-294 (Authentication Bypass): https://cwe.mitre.org/data/definitions/294.html
5. Microsoft Detection and Mitigation Guide: https://microsoft.github.io/CSS-Exchange/Security/CVE-2023-23397/