Heimdal® internal data revealed that, at the time this article was being written, more than 70% of our customers have already deployed Microsoft’s official fix for CVE-2023-23397. Since the vulnerability can be triggered in the absence of user interaction, CVE-2023-23397 can be regarded as having worm-like capabilities. Given the implications of the vulnerability, Microsoft has assigned it a CVSS 3.1.9.8 score of 9.1 (i.e., Critical). In some instances, this action occurs long before the email hits Outlook’s preview pane. The method involves the involuntary disclosure of the victim’s Net-NTLM v.2 hash, which results in the threat actor declining his identity with the stolen credentials via an ancillary Windows service. According to the advisory released by Microsoft, CVE-2023-23397, which was labeled as the Pass-the-Hash attack, shows that the victim’s credentials are automatically passed to the attacker once the crafted email pops up in the inbox. However, this is where the good news ends the vulnerability itself does not require user interaction. Furthermore, a closer investigation revealed that the bug seems to be contained in Windows Server 2022 and Windows 11, meaning it does not affect older builds or legacy. Microsoft Outlook Vulnerability Status Changed from POC to EOPĭiscovered in or around the beginning of March, the Microsoft Outlook vulnerability was found to affect several applications from the Microsoft 365 Apps Enterprise stack, including MS Office 2019, 2016, 2013, and LTSC. Research suggests that the bug, which was formally attributed to a Microsoft Outlook component, has a high ‘wormability’ factor, in most instances the user interaction phase being no longer necessary. Earmarked CVE-2023-23397, the vulnerability allows an unauthenticated threat actor to obtain the user’s credentials by passing along a crafted email package.

The cyber-research community raises concerns over a vulnerability that puts the Microsoft 365 suite at risk.

Outlook 365