Microsoft Outlook Security Flaw Exposes User Passwords to Attackers

Recently, a security flaw in Microsoft Outlook was discovered that could be exploited by threat actors to access NT LAN Manager (NTLM) v2 hashed passwords when opening a specially crafted file. The issue, tracked as CVE-2023-35636 (CVSS score: 6.5), was addressed by the tech giant as part of its Patch Tuesday updates for December 2023.

The vulnerability is rooted in the calendar-sharing function in the Outlook email application, wherein a malicious email message is created by inserting two headers "Content-Class" and "x-sharing-config-url" with crafted values in order to expose a victim's NTLM hash during authentication. Varonis security researcher Dolev Taler, who has been credited with discovering and reporting the bug, said NTLM hashes could be leaked by leveraging Windows Performance Analyzer (WPA) and Windows File Explorer. These two attack methods, however, remain unpatched.

In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. Microsoft said in an advisory released last month. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability.

It is important to note that the vulnerability has been patched by Microsoft, and users are advised to update their software to the latest version to avoid any potential security risks.