PoC Exploit Released for Critical Outlook 0-Click Remote Code Execution Vulnerability
A Proof-of-Concept (PoC) exploit code has been released for a critical remote code execution (RCE) vulnerability in Microsoft Outlook, identified as CVE-2024-21413 .
A Proof-of-Concept (PoC) exploit code has been released for a critical remote code execution (RCE) vulnerability in Microsoft Outlook, identified as CVE-2024-21413 .
Dubbed “MonikerLink,” this flaw allows attackers to bypass Outlook’s security mechanisms, specifically the “Protected View,” to execute malicious code or steal credentials. The release of this PoC highlights the continued risk posed by this vulnerability and serves as a training tool for security professionals to understand the attack vector.
The vulnerability, assigned a CVSS score of 9.8, resides in how Microsoft Outlook parses specific hyperlinks known as “Moniker Links”. Typically, Outlook’s Protected View restricts potentially harmful content, such as files from the internet, by opening them in a read-only mode.
However, the MonikerLink flaw allows an attacker to circumvent this protection by using the file:// protocol followed by an exclamation mark and additional text in a specially crafted link.
When a victim clicks this link, Outlook attempts to access the resource without the usual security warnings. This action can trigger an SMB connection to an attacker-controlled server, leading to the leakage of the victim’s local NTLM credentials.
In more severe scenarios, this bypass can facilitate remote code execution, giving attackers significant control over the compromised system.
The newly released Python-based PoC, available on GitHub, demonstrates how to exploit this vulnerability in a controlled lab environment.
Typically, Outlook’s Protected View restricts potentially harmful content, such as files from the internet, by opening them in a read-only mode.
The script is designed to work with a specific setup involving hMailServer and targets a victim user running a vulnerable version of Outlook. It automates the process of sending a malicious email containing the Moniker Link to a victim’s inbox.
The author of the PoC notes that the script assumes a specific configuration, such as the absence of TLS authentication , to simplify the testing process for educational purposes.
While the code is basic and intended for a specific audience, likely users of the “MonikerLink” room on the TryHackMe platform, it effectively illustrates the mechanics of the attack. For those seeking more advanced or developed exploitation tools, the author references alternative repositories, such as the one by security researcher Xaitax.
Defenders can detect attempts to exploit this vulnerability by monitoring for specific patterns in email traffic. Security researcher Florian Roth has released a YARA rule designed to identify emails containing the file:\\ element used in the exploit.
This rule helps organizations flag suspicious messages that may be attempting to leverage the MonikerLink flaw before they reach the end-user.
Microsoft has released official updates to address CVE-2024-21413 , and organizations are strongly advised to apply these patches immediately.
The availability of public exploit code, even for educational purposes, increases the likelihood of threat actors adopting similar techniques.
Security teams should ensure that all Microsoft Office instances are up to date and consider blocking outbound SMB traffic (port 445) to prevent NTLM credential leakage to external servers.
Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories.
Based on reporting by Cyber Security News.