Posts Tagged ‘Morphisec’
[DefCon32] DEF CON 32: Outlook Unleashing RCE Chaos: CVE-2024-30103
Michael Gorelik and Arnold Osipov, security researchers from Morphisec, unveiled a series of devastating remote code execution (RCE) vulnerabilities in Microsoft Outlook at DEF CON 32. Their presentation focused on CVE-2024-30103, an evolution of CVE-2024-21378, which exploits Outlook’s COM object forms to trigger RCE from seemingly benign emails. Michael and Arnold’s meticulous research revealed additional NTLM credential leaks, exposing systemic weaknesses in Outlook’s security model and offering critical mitigation strategies.
The Evolution of Outlook Exploits
Michael kicked off by tracing the timeline of Outlook vulnerabilities, noting how incomplete patches often leave residual attack surfaces. He explained how CVE-2024-21378, a flaw in Outlook’s form handling, opened the door to RCE by allowing attackers to embed malicious COM objects in emails. Morphisec’s research built on this, uncovering CVE-2024-30103, which exploits trusted sender scenarios to execute code automatically upon email preview. Michael’s narrative highlighted the cascading effect of these vulnerabilities, turning routine email interactions into potential attack vectors.
Exploiting NTLM Leaks
Arnold delved into the NTLM credential leak issue, which Microsoft rated as medium risk due to mitigations like preview mode for untrusted senders. However, he demonstrated how compromised internal accounts could bypass these protections, enabling automatic image downloads that trigger NTLM leaks. Arnold’s analysis revealed that domain-joined devices are particularly vulnerable, as attackers can exploit trusted sender status within organizations to harvest credentials, amplifying the risk of lateral movement across networks.
Technical Breakdown of RCE Chains
Michael provided a detailed breakdown of the RCE exploit chain, showcasing how attackers manipulate Outlook’s form controls to execute arbitrary code. He highlighted the role of compound monitors, which process email content, in enabling these attacks. By leveraging insights from researchers like NetSPI and Check Point, Morphisec constructed a robust exploit that bypasses existing patches. Michael’s technical exposition underscored the complexity of securing Outlook’s extensive attack surface, particularly when patches introduce new vulnerabilities.
Mitigating Outlook Vulnerabilities
Concluding, Arnold shared actionable recommendations, including enabling SMB signing, managing outbound SMB traffic, and adopting Windows 11’s default NTLM restrictions. He emphasized the need for organizations to monitor trusted sender configurations and enhance email security protocols. Michael and Arnold’s work, supported by Morphisec’s threat research, calls for a reevaluation of Outlook’s security architecture, urging the cybersecurity community to collaborate on robust defenses against these evolving threats.