CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability

CVE-2024-21413 is a critical remote code execution vulnerability in Microsoft Outlook (versions including Microsoft 365 Apps, Outlook 2016/2019, Office LTSC 2021 before February 2024 patch). It allows an unauthenticated attacker to bypass Outlook’s Protected View by sending a specially crafted email containing a file:// link with an exclamation mark (!). When the victim clicks the link (or even just previews the email), Outlook automatically attempts to connect to the attacker’s SMB server, leaking the victim’s NetNTLMv2 hash.

With these credentials, an attacker can crack the password or perform a Pass‑the‑Hash attack to impersonate the user, move laterally across the network, or achieve remote code execution.

CVSS Score: 9.8 (Critical) CWE: CWE-20 (Improper Input Validation) Patched version: Microsoft security update (KB5002519 for Office 2016) released February 13, 2024

⚙️ How the Exploit Works Attacker sets up an SMB listener on their machine (e.g., Responder).

Attacker sends an email to the victim containing a hyperlink like: file:///test!exploit

Victim opens the email and clicks the link (or the link is previewed in the reading pane).

Outlook makes an SMB connection to , automatically sending the victim’s Windows username and NTLM hash.

Attacker captures the hash with Responder.

Attacker cracks the hash offline or relays it to authenticate as the victim on other systems.