Threat Brief - CVE-2023-23397 - Microsoft Outlook Privilege Escalation
Summary: Microsoft patched CVE-2023-23397 on March 14, 2023, an Outlook for Windows flaw where a specially crafted .msg file with a custom PidLidReminderFileParameter property pointing to an attacker-controlled SMB server leaks the targeted user's Net-NTLMv2 hashes with no user interaction required. Microsoft traced potential exploitation back to April 2022, with observed attacks limited to Russia-attributed threat actors targeting Ukrainian infrastructure.
Why it matters: The patch itself may be insufficient: it calls IsFileZoneLocalIntranetOrTrusted on the file path, which still permits an internal connection if an attacker already has a foothold, making NTLMv2 relay attacks and lateral movement trivial from inside the network.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2023-23397
- Related
- Fighting Ursa Aka APT28: Illuminating a Covert Campaign Cyber Risks ·CVE-2023-23397: Microsoft Office Outlook Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Mar 14, 2023