#CyberVeille #cve202323397 CVE-2023-23397
🔗​
The Guidance
👇​
https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/

The oopsie
👇​
1) un simple message avec la MAPI PidLidReminderFileParameter renseignée suffit

2) le 0-click reste exploitable en réseau interne si l'attaquant défini un host name (sans point) dans le chemin UNC (le patch ne couvre pas ce cas de figure apparemment pour préserver une fonctionnalité de ...confort)

[je sens que cette technique va devenir un classique pentest/redteam]

👇​
🐦​🔗​https://twitter.com/wdormann/status/1636784861036806161

👇​
🐦​🔗​https://twitter.com/an0n_r0/status/1640304974755135488

I'm once again asking if _anyone_ has seen the PoCs for #CVE202323397 actually work against remote targets.

MDSec demo: local attack
Hammond's demo: local attack
My own testing: local attack

With both flavors of PoC right now, I can only get this thing to trigger on my own machine, but not recipients. The invite is received, but the SMB server is not contacted by the target. I'm wondering if we're missing something here.

#InfoSec #ThreatIntel #CyberSecurity

Good stuff here for detecting #cve202323397

https://www.trustedsec.com/blog/critical-outlook-vulnerability-in-depth-technical-analysis-and-recommendations-cve-2023-23397/

#ThreatIntel #InfoSec #CyberSecurity

For those tracking #cve202323397 some notes.

1. Will Dormann reports that the patch from MS only stops UNC paths with `.` in them. That means local hostnames are still fair game, and this was always scarier as a post-exploitation TTP.

2. I have yet to see a demo where the thing is triggered on a remote target. I can pop my own NTLM hash with existing PoCs, but not others, which may be a limiting factor.

#ThreatIntel #InfoSec #CyberSecurity

So the Outlook jawn.

Sending NTLMv2 hashes to the web sucks, but to me this is scarier as a post-exploit spearphishing tool. Imagine hanging out in a network with Inveigh/Responder, then being able to email the exact person whose hash you want.

#CVE202323397 #InfoSec #CyberSecurity

Partial mitigation for CVE-2023-23397 if you are running ESET is to configure your trusted zone and enable "Deny NTLM authentication in SMB protocol for connecting a server outside the Trusted zone". (This is ESET firewall Trusted Zone not the Windows one)

While this won't stop the WebDAV authentication it's a good mitigation to consider.

Kudos to @[email protected] for testing it. https://twitter.com/donnymaasland/status/1635918233487265793

#CVE202323397