A new critical vulnerability impacting Microsoft Office, identified by the reference CVE-2024-21413, has been reported. It has been assigned a CVSS 3.1 score of 9.8. It should be noted that, an important number of proofs of concepts are freely available, enabling a huge potential of exploitation by threat actors. The Stormshield Customer Security Lab details our protection offerings.
This vulnerability impacts the following products:
- Microsoft Office 2016
- Microsoft Office 2019
- Microsoft Office 2021
- Microsoft 365 Apps
The OWA (Outlook Web Application) version is not impacted.
The context of Microsoft Office vulnerability
The vulnerability CVE-2024-21413 allows an attacker to:
- Execute an arbitrary code through the indirect opening of an Office document bypassing the protected mode;
- Disclose sensitive information on the identity of the user (hash NTLM).
In the first case, a payload could be executed in the context of the targeted Office program.
In the second case, the NTLM hash could be reused in a Pass-The-Hash attack in order to spoof the identity of the user.
Technical details of Microsoft Office vulnerability
The root cause of this vulnerability comes from the interpretation of some hypertext links by the Office suite, especially the links relying on the COM Monikers technology.
If this link is pointing to a SMB share – in the form \\<Malicious_IP>\file – then the Office program will automatically try to authenticate on this remote server by sending it the NTLM hash of the current user. If this SMB server is sending a malicious file like an RTF, then a program likes Microsoft Word will load the file and executes it.
Attack modelling with MITRE ATT&CK
- Kill chain: Delivery
MITRE ATT&CK techniques:
- T1566.002 - Phishing: Spearphishing Link
- T1559.001 - Inter-Process Communication
- T1204.001 - User Execution: Malicious Link
Microsoft Office vulnerability: Stormshield protections
Protection with Stormshield Network Security
Stormshield Network Security (SNS) firewalls detect and block exploitation of CVE-2024-21413 with its protocol inspection:
- smtp:client.15 : eMail : Microsoft Outlook malicious Moniker link (CVE-2024-21413)
For this protection to be efficient, the traffic must be decrypted.
Confidence index for the protection offered by Stormshield |
Confidence index for the absence of false positives |
Recommendations regarding the Microsoft Office vulnerability
At the time of writing, a patch of the Office suite is already available. It is highly recommended to update the product through Windows Update.
The details of the patch are available on the Microsoft website to the following address.
