Outlook Reminder NTLM Leak

We've just published a quick write on CVE-2023-23397, which allows a remote adversary to leak NetNTLMv2 hashes: mdsec.co.uk/2023/03/exploi... by @domchell all the properties that are part of the <see cref="Appointment"> object either as <see cref="CFStream"/>'s to the <see cref="CompoundFile.RootStorage"/> public void WriteToStorage() IPM_Appointment; PidLidLocation, Location PidLidAppointmentStartWhole, MeetingStart PidLidAppointmentEndWhole, MeetingEnd PidLidMeetingType, Appointment.mtgRequest PidLidAppointmentSubType, AllDay PidLidAppointmentStateFlags, AppointmentState.asMeeting PidLidReminderFileParameter, PidLidReminderFileParameter PidLidReminderOverride, PidLidReminderOverride

A screenshot of an MDSec tweet announcing a write-up about CVE-2023-23397, with a code snippet showing Outlook appointment properties, including reminder settings. The joke is the alarming contrast between ordinary calendar reminders and the vulnerability allowing a remote attacker to leak NetNTLMv2 hashes through an external reminder sound location. EN: A screenshot of an MDSec tweet announcing a write-up about CVE-2023-23397, with a code snippet showing Outlook appointment properties, including reminder settings. The joke is the alarming contrast between ordinary calendar reminders and the vulnerability allowing a remote attacker to leak NetNTLMv2 hashes through an external reminder sound location.

• @gentoomemes / 3140 2023-03-15