CVE-2024-21413 - Critical Remote Code Execution Vulnerability in Microsoft Outlook

Setup

1. Create a config.ini file in the same directory as the script with the following format:

[email_credentials]
sender_email = [email protected]
sender_password = your_app_password
smtp_server = smtp.gmail.com
smtp_port = 587

2. Create a template folder and place Stripo.html inside it

Usage

1. Run the script:

python3 CVE-2024-21413.py

2. Available commands:

help    - Show all available commands
set     - Set configuration options
  - set subject <text>    - Set email subject
  - set link <url>        - Set link in email
  - set count <number>    - Set number of emails to send
show    - Show current settings
add     - Add recipient email
load    - Load email list from file
send    - Send emails
clear   - Clear screen
exit    - Exit program

3. Usage example:

CVE-2024-21413 > set subject "Test Email"
CVE-2024-21413 > set link https://example.com
CVE-2024-21413 > set count 2
CVE-2024-21413 > add [email protected]
CVE-2024-21413 > send

Loading Emails from File

1. Create a text file (e.g., emails.txt) with one email address per line:

[email protected]
[email protected]
[email protected]

2. Use the load command:

CVE-2024-21413 > load emails.txt

Overview

CVE-2024-21413 is a critical remote code execution (RCE) vulnerability affecting Microsoft Outlook. This zero-day vulnerability, also known as the "MonikerLink" bug, allows attackers to execute arbitrary code on a victim's machine without any user interaction. The vulnerability is triggered by maliciously crafted email messages that exploit specific types of hyperlinks within Outlook, leading to severe consequences such as system compromise, data exfiltration, or the installation of malware.

Affected Versions

The vulnerability affects various versions of Microsoft Outlook, including but not limited to:

• Microsoft Office 2016
• Microsoft Office 2019
• Microsoft Office 2021
• Microsoft 365 Apps

These versions are affected across both 32-bit and 64-bit editions.

Attack Vector

The MonikerLink bug is particularly dangerous because it bypasses the Office Protected View feature, which is designed to open potentially unsafe files in a read-only, sandboxed environment. By exploiting this vulnerability, attackers can bypass these security mechanisms and gain unauthorized access to sensitive information or take control of the victim's system.

Impact

Successful exploitation of CVE-2024-21413 can result in:

• Remote code execution
• Data exfiltration
• Data encryption
• Credential harvesting
• Installation of malware

Given the severity of this vulnerability, it is crucial that affected systems be patched immediately to prevent potential exploitation.

Mitigation

To protect against this vulnerability, it is strongly recommended that users and organizations:

• Apply the latest security updates provided by Microsoft.
• Ensure that Outlook and all related Office applications are updated to the latest versions.

For further details and updates, refer to the following sources:

• Recorded Future
• Triskele Labs
• Vulcan Cyber

License

This document is licensed under the MIT License.