Recent research by Check Point Research (CPR) has highlighted a significant security vulnerability in Microsoft Outlook, referred to by CPR as the #MonikerLink bug.
The vulnerability has been recognised by Microsoft in CVE-2024-21413, which states that: “Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.”
The #MonikerLink vulnerability specifically exploits the way Outlook processes certain hyperlinks, leading to severe security implications. It could allow an attacker to execute arbitrary code on the victim’s machine.
CVE-2024-21413 also states that the vulnerability has a maximum severity of Critical.
CPR’s key findings:
- Hyperlink handling in Outlook: the research demonstrates that ‘file://’ hyperlinks can be manipulated in a certain way which results in a bypass of the Outlook’s security measures such as Protected View.
- The impact: the #MonikerLink bug allows for a wide and serious impact, varying from leaking of local NTLM credential information to arbitrary code execution. This is due to the misuse of the Component Object Model (COM) on Windows, where Outlook incorrectly parses a specially crafted hyperlink to access COM objects. This process can bypass the Office Protected View, significantly increasing the risk of exploitation for remote code execution without the user’s knowledge.
- Microsoft’s acknowledgement and CVSS Severity Score: Microsoft has acknowledged the vulnerability, and the flaw has received a CVSS severity score of 9.8 out of 10, underlining its critical nature.
- The bigger picture: the #MonikerLink bug underscores a broader security risk associated with the use of unsafe APIs, such as MkParseDisplayName/MkParseDisplayNameEx, potentially affecting not only Outlook but other software that uses these APIs insecurely. The discovery of this bug in Outlook serves as a call to action for the security and developer communities to identify and rectify similar vulnerabilities in other applications, ensuring the safety of the Windows/COM ecosystem.
Microsoft has released updates which must be installed to deal with this critical vulnerability.
