{"id":110202,"date":"2023-07-19T12:00:41","date_gmt":"2023-07-19T12:00:41","guid":{"rendered":"https:\/\/kasperskycontenthub.com\/securelist\/?p=110202"},"modified":"2023-07-19T09:43:20","modified_gmt":"2023-07-19T09:43:20","slug":"analysis-of-attack-samples-exploiting-cve-2023-23397","status":"publish","type":"post","link":"https:\/\/securelist.com\/analysis-of-attack-samples-exploiting-cve-2023-23397\/110202\/","title":{"rendered":"Comprehensive analysis of initial attack samples exploiting CVE-2023-23397 vulnerability"},"content":{"rendered":"

On March 14, 2023, Microsoft published a blogpost<\/a> describing an Outlook Client Elevation of Privilege Vulnerability (CVSS: 9.8 CRITICAL). The publication generated a lot of activity among white, grey and black hat researchers, as well as lots of publications and tweets about the vulnerability and its exploitation. Below, we will highlight the key points and then focus on the initial use of this vulnerability by attackers before it became public.<\/p>\n

Affected products include all supported versions of Microsoft Outlook for Windows. Other versions of Microsoft Outlook, such as those for Android, iOS, macOS, and Outlook on the web and other MS365 services, are not affected.<\/p>\n

The CVE-2023-23397 vulnerability<\/h2>\n

From a technical point of view, the vulnerability is a critical EoP that is triggered when an attacker sends an Outlook object (task, message, or calendar event) within an extended MAPI property that contains a UNC path to an SMB share on a threat actor-controlled server, resulting in a Net-NTLMv2 hash leak. No user interaction is required.<\/strong> The NTLM leak occurs when the reminder window is displayed, not just when the message is received. However, an already expired reminder will be fired immediately upon receipt of the object!<\/p>\n

The connection to the remote SMB server sends the user’s Net-NTLMv2 hash in a negotiation message, which the threat actor can use to either:<\/p>\n