CVE-2023-23397: Microsoft Outlook Zero-Day Exploited by APT28

Summary

A now fixed zero-day elevation of privilege (EoP) vulnerability in Microsoft Outlook (CVE-2023-23397) allows attackers to send craft emails to exploit Outlook. The vulnerability does not require user interaction to be exploited and runs even before the email is visualized in the preview pane of Outlook, which makes this vulnerability even more dangerous.

CVE-2023-2339 was being exploited by APT28 (a.k.a. Fancy Bear, Pawn Storm), an APT group linked to Russia’s military intelligence service GRU, to target European organizations. According to public reports, this vulnerability was used by APT28 between April and December 2022 to target and breach multiple sectors, including government, military, and energy, stealing Windows credentials that were then used for lateral movement and email exfiltration.

CVE-2023-23397

The vulnerability consists of a critical elevation of privilege flaw that can be exploited without user interaction. An attacker could exploit this issue by sending specially crafted messages with extended Microsoft Outlook Messaging API (MAPI) properties that contain Universal Naming Convention (UNC) paths pointing to an SMB share controlled by the attacker.

This would allow the attacker to capture the user’s NTLM hashes through the SMB server connection when the email is delivered to the target’s email inbox. NTLM hashes can then be relayed to other systems to perform authentication, lateral movements, or data exfiltration. 

This vulnerability affects all versions of Microsoft Outlook for Windows. Other platforms, such as Android, iOS and MacOS are not affected. Also, this vulnerability does not affect the online services, like Microsoft 365 Outlook, as they do not not support NTLM authentication.

Mitigation and Protection

Update / Patch

CVE-2023-23397 has already been fixed by Microsoft and we strongly recommend Outlook users to immediately update the software to address this issue. Microsoft also released a PowerShell script that can be used by network administrators to check whether an Exchange messaging item (mail, calendar, and tasks) are populated with a UNC path. 

Netskope Cloud Firewall

Netskope Cloud Firewall customers who cannot immediately patch all affected machines can configure a rule to block all outbound connections to external SMB servers (port 445).