Unpacking CVE- Understanding the Vulnerability

Deep Dive into CVE-2024-21413

Microsoft Outlook contains a critical remote code execution vulnerability, CVE-2024-21413. This flaw allows attackers to bypass Outlook's Protected View and leak NTLM credentials. It carries a CVSS v3.1 score of 9.8, categorizing it as critical. All supported versions of Microsoft Outlook for Windows released before the February 2024 security updates are affected. This vulnerability enables attackers to gain unauthorized access and potentially execute arbitrary code on a victim's system. A successful attack requires user interaction, typically opening a specially crafted file.

What the Vulnerability Is and Its Impact

CVE-2024-21413 allows an attacker to bypass the Mark-of-the-Web (MotW) security feature. MotW flags files downloaded from untrusted sources, prompting security warnings and opening them in Protected View. This vulnerability circumvents these protections. An attacker can craft a malicious file, such as an Internet Shortcut (.URL) or Calendar (.ICS) file. When a user opens this file, Outlook attempts to connect to a remote resource specified within. This connection can force NTLM authentication to an attacker-controlled server. The attacker can then capture and relay these NTLM hashes. This can lead to impersonation and unauthorized access to other network services. The vulnerability also enables remote code execution by allowing malicious files to open without Protected View.

Technical Root Cause Analysis

The root cause of CVE-2024-21413 lies in Outlook's insecure handling of specific file types and URI schemes. Specifically, the vulnerability exploits how Outlook processes Internet Shortcut (.URL) files and Calendar (.ICS) files. These files can contain references to remote resources using the file:// URI scheme. Outlook, when processing these references, initiates an authentication attempt to the specified remote server. This occurs even if the server is external and untrusted. The critical flaw is the lack of proper validation and sanitization of these external resource requests. This bypasses the typical security checks that would prevent NTLM credential leakage or direct execution of untrusted content.

Another contributing factor is the ability to bypass Protected View. Protected View is a security measure designed to open potentially unsafe files in a read-only, isolated environment. This vulnerability allows an attacker to craft files that Outlook processes outside of this sandbox. For example, an attacker can embed a malicious HTML file within a remote share linked by the .URL file. When the user opens the .URL file, Outlook fetches and renders the HTML directly, bypassing Protected View. This direct rendering can enable client-side script execution, leading to remote code execution.

Exploitation Mechanics

Exploitation of CVE-2024-21413 typically begins with a phishing attack. The attacker sends an email containing a specially crafted Internet Shortcut (.URL) file or a Calendar (.ICS) file. This file contains a reference to an attacker-controlled server, often using a file:// URI pointing to a UNC path or a WebDAV share. When the victim opens the malicious file, Outlook attempts to retrieve the resource. This action triggers an NTLM authentication request from the victim's machine to the attacker's server. The attacker's server captures the victim's NTLM hash.

The captured NTLM hash can then be relayed to other services on the network. This allows the attacker to authenticate as the victim. For instance, the attacker could relay the hash to an internal SMB share or another service that uses NTLM authentication. This impersonation grants the attacker access to resources the victim has permissions for. The Protected View bypass further enhances the attack. The malicious .URL file can point to a remote HTML file hosted on the attacker's server. This HTML file can contain JavaScript or VBScript. Outlook executes this script without warnings or sandboxing, leading to remote code execution. Attackers can leverage the outlook:// protocol handler to open local files or specific Outlook items, further extending their control.

Detection: How to Check if You're Affected

Detecting CVE-2024-21413 involves monitoring for suspicious activities and configurations. Organizations should implement robust endpoint detection and response (EDR) solutions. These tools can identify unusual process behavior, such as Outlook attempting to connect to external SMB or WebDAV shares. Look for outbound NTLM authentication attempts to non-corporate IP addresses. Network intrusion detection systems (NIDS) can also flag these suspicious NTLM authentication flows.

Administrators should examine email traffic for malicious attachments. Look for unexpected .URL or .ICS files, especially those containing file:// or UNC paths pointing to external resources. Review security logs for NTLM authentication events. Pay attention to authentication attempts originating from Outlook processes to unusual destinations. Tools like Secably's free safe browsing checker can help identify potentially malicious URLs in general, though direct detection of this specific vulnerability requires deeper endpoint and network monitoring. Regular checks using a HTTP security headers checker ensure your web infrastructure mitigates other common web-based attack vectors, complementing endpoint security. For more information on similar threats, refer to our blog post on Unpacking Critical RCE Vulnerabilities (CVEs).

Organizations can also use Secably for continuous attack surface management. Its vulnerability scanning capabilities help identify unpatched systems that remain vulnerable to known CVEs like this. Secably offers a free tier for instant tools and paid monitoring plans starting at $19/month.

Remediation Steps

Immediate remediation for CVE-2024-21413 involves applying the vendor-provided patches. Microsoft released security updates addressing this vulnerability on February 13, 2024, as part of their Patch Tuesday release. Deploy these updates across all affected Microsoft Outlook installations without delay. This is the most effective way to eliminate the vulnerability.

Beyond patching, implement several compensating controls. Block outbound NTLM authentication to the internet at the network perimeter. Configure firewalls and proxy servers to prevent direct SMB or WebDAV connections from internal clients to external IP addresses. Enable Extended Protection for Authentication (EPA) on Windows servers. This helps mitigate NTLM relay attacks by binding NTLM authentication to specific channels. Consider implementing Group Policy Objects (GPOs) to restrict the execution of specific file types, such as .URL files, from untrusted locations. Educate users about phishing risks and suspicious email attachments. Advise caution when opening files from unknown senders, even if they appear benign.

Timeline of Disclosure

• Late 2023: Roman S. of Check Point Research identified and reported the vulnerability to Microsoft.
• February 13, 2024: Microsoft released security updates for CVE-2024-21413 as part of their monthly Patch Tuesday release.
• February 2024: Check Point Research publicly disclosed their findings and technical analysis following Microsoft's patch release.