BI.ZONE CESP swiftly responds to protect Outlook users against CVE-2023-23397

In March 2023, Microsoft announced a vulnerability that enabled cybercriminals to compromise Outlook accounts. The vendor labeled the vulnerability CVE-2023-23397 and rated its severity at 9.8 out of 10 on the CVSS scale.

The attack leads to an unauthorized authentication.

1. The user receives a message with a calendar item or a task that refers to a UNC path controlled by the adversaries. This value is specified in PidLidReminderFileParameter which provides the location of the audio file to be played when an Outlook reminder becomes overdue for a specific event or task.
2. Even if the user does not confirm participation in an event or accept a task, the victim’s Outlook client contacts an illegitimate server.
3. The illegitimate server requests NTLM authentication.
4. The victim’s Outlook client sends the first NTLM hash with the victim’s name and general information (all in Base64).
5. The adversaries obtain credentials for authentication.

In other words, the attackers generate an illegitimate file with .msg extension where they specify the following parameters and their values:

• PidLidReminderOverride = true; permission to set a user audio file for a reminder
• PidLidReminderFileParameter = ""; the value specifying the path to the adversaries’ sever

This way they initiate an NTLM relay attack followed by obtaining the NTLM hash and compromising credentials. Microsoft has already released a special update addressing the described attack. However, not all companies are ready to install patches as soon as they become available.

The BI.ZONE CESP team has quickly developed a detection mechanism against the new vulnerability. The mechanism scans messages and attachments for CVE-2023-23397 even before they appear in the user’s inbox. All clients of the BI.ZONE CESP service already have the mechanism automatically installed, so their email cannot be compromised by attackers.