New Vulnerability in Microsoft Outlook: CVE-2024-30103
Recent findings by Morphisec researchers have exposed a critical flaw in Microsoft Outlook, designated CVE-2024-30103. This vulnerability enables the execution of harmful code the moment an email is accessed.
We will delve into the technical specifics of CVE-2024-30103, exploring its exploitation methods and evaluating its possible impact on your systems. This security issue poses a severe risk, permitting remote code execution via maliciously crafted Outlook Forms.
Technical Overview of CVE-2024-30103
Earlier this year, Netspi identified a related vulnerability, CVE-2024-21378, which allowed authenticated remote code execution through synchronized form objects in Outlook. Building on these findings, Morphisec has discovered CVE-2024-30103.
This new vulnerability stems from a weakness in the allow-listing process, which inadequately verifies form server properties. As a result, unauthorized custom forms can be instantiated.
Specifically, the flaw lies in the handling of registry paths by the allow-listing mechanism. The Windows API function RegCreateKeyExA plays a crucial role, as it strips trailing backslashes from registry key names, facilitating the creation of nested keys. By exploiting this, attackers can manipulate registry paths to point to malicious executables, which are then triggered when a specially crafted email is opened.
The critical issue arises from how the function processes trailing backslashes. For instance, “InprocServer32\” is interpreted as “InprocServer32” due to this discrepancy, allowing attackers to bypass exact matching algorithms and load malicious code. Researchers demonstrated that placing a harmful executable in the AppData local Forms folder enables this exploit, activating the malicious form server when a targeted email is opened.
This vulnerability enables attackers to execute arbitrary code within the Outlook environment, potentially leading to data breaches and unauthorized access through methods like loading malicious DLL files or leveraging COM properties such as LocalServer32.
Mitigation and Patch Information
Microsoft has recently addressed this vulnerability in a security update. The revised patch modifies the allow-listing algorithm to improve system defenses. The update now strips trailing backslashes from subkey names before performing exact matches, aiming to close the security gap identified.
Additionally, Microsoft has enhanced its denylist to thwart remote code execution attacks that could exploit subkey manipulation techniques. These improvements reflect Microsoft’s ongoing efforts to bolster security and protect users from emerging threats.
Despite the patch, the dynamic nature of security threats necessitates vigilance. Organizations should maintain up-to-date security patches and conduct regular audits to defend against potential exploits. Users are encouraged to implement the latest updates and adhere to best practices to safeguard their systems from such vulnerabilities.
