CYPHERLOCK, INC.

Technical Insights Unveiled for Outlook’s Zero-Click RCE Flaw

Researchers at Morphisec have revealed crucial insights into a newly discovered zero-click remote code execution (RCE) vulnerability in Microsoft Outlook, designated CVE-2024-38021. This vulnerability presents a severe security threat by enabling attackers to execute arbitrary code without requiring user interaction.

The flaw arises from how Outlook processes composite monikers within image tag URLs. Unlike the earlier CVE-2024-21413, which was related to hyperlink parsing, CVE-2024-38021 exploits the mso30win32client!HrPmonFromUrl function. This function, responsible for handling URLs in image tags, fails to set the BlockMkParseDisplayNameOnCurrentThread flag, allowing it to process unsafe composite monikers through the MkParseDisplayName function.

The attack involves embedding a composite moniker in an image tag URL, circumventing security mechanisms designed to protect against such exploits and leading to potential remote code execution and local NTLM credential leaks.

Microsoft’s Response

Microsoft’s fix for CVE-2024-38021 involves applying the BlockMkParseDisplayNameOnCurrentThread flag to the HrPmonFromUrl function, thereby preventing the execution of the vulnerable MkParseDisplayName function with composite monikers in image URLs.

However, researchers have noted that using a simple file moniker can still result in local NTLM credential leaks, suggesting that the patch may not address all security concerns fully.

Microsoft has rated this vulnerability as “Important,” with different implications for trusted and untrusted senders. For trusted senders, the exploit requires no user interaction, while untrusted senders necessitate one-click interaction.

Due to the potential wide-reaching impact and the zero-click capability for trusted sources, Morphisec has urged Microsoft to reconsider and classify the vulnerability as “Critical.”

To mitigate risks, organizations should:

  1. Update Microsoft Outlook and Office applications immediately.
  2. Adopt stringent email security practices, such as disabling automatic email previews.
  3. Educate users about the dangers of opening emails from unknown sources.

Additionally, employing Automated Moving Target Defense (AMTD) strategies can significantly lessen the likelihood of exploitation from vulnerabilities like CVE-2024-38021.

More Articles & Posts

Scopes

2025 Active Exploitation AI Alert Analysis Attack Attackers Attacks Breach Breaches Campaigns China chrome CISA Cisco CISO CISOs credentials Critical Critical Flaw Critical Vulnerability CrowdStrike Cutting-Edge Cyber Attack Cyberattack cyberattacks Cybercriminals cybersecurity Cybersecurity Initiatives Cybersecurity Solutions Cyber Threats DDoS Attacks Discovered Enables Exploit Exploited Exploiting Exploits Exposes FBI Flaw Generative AI google Guide Hackers Hackers Exploit Healthcare Hijack Hit Insights Invest Ivanti Linux macOS malicious malware Massive data Breach MFA microsoft Microsoft 365 Microsoft Azure NIST Patch Phishing Phishing Attack PoC Privilege Escalation Ransomware Ransomware Attack ransomware attacks RCE RCE Vulnerability Released Remote Code Execution Researchers risk Scam security Security Flaw Strategies Strategy Systems Target Targeted Targeting Targets Threat Actors Threat Intelligence threats UK Unauthorized Code Execution Under Attack Users vulnerabilities Vulnerability WhatsApp windows Windows 11 Windows Systems Zero-Day