Is it in the wild? What versions and operating systems (OS) are affected? We elaborate on this example in our webinar (at 04:23 of the video). The attacker could use the same credentials to gain access to other resources. It is difficult to block outbound SMB traffic for remote users. CVE-2023-23397 is a zero-touch vulnerability that is triggered when the victim client is prompted and notified (e.g., when an appointment or task prompts five minutes before the designated time).

User interaction is not necessary to trigger (even before message preview) it, nor does it require high privileges. While online services such as Microsoft 365 are not susceptible to this attack because they do not support NTLM authentication, the Microsoft 365 Windows Outlook app is still vulnerable. As such, threat actors can attempt a NTLM relay attack to gain access to other services, or a full compromise of domains if the compromised users are admins.

NTLMv2 hashes are the latest protocol Windows uses for authentication, and it is used for a number of services with each response containing a hashed representation of users’ information, such as the username and password. When the victim connects to the attacker’s SMB server, the connection to the remote server sends the user’s New Technology LAN Manager ( NTLM) negotiation message automatically, which the attacker can use for authentication against other systems that support NTLM authentication. msg - the message format that supports reminders in Outlook - to trigger the vulnerable API endpoint PlayReminderSound using “PidLidReminderFileParameter” (the custom alert sound option for reminders). The attacker remotely sends a malicious calendar invite represented by. Share-hosted on a server controlled by the attacker, the vulnerability is exploited whether the recipient has seen the message or not. The attacker sends a message to the victim with an extended Message Application Program Interface (MAPI) property with a Universal Naming Convention (UNC) path to a remote attacker-controlled Server Message Block (SMB, via TCP 445).

Microsoft azure mfa