Avi Douglen

-7- Outlook Unleashing RCE Chaos: CVE-2024-30103 & CVE-2024-38021 - Michael Gorelik, Arnold Osipov Sometimes, a vendor releases a patch fixing a vulnerability you are working on. Disappointing, isn't it? In this talk, Michael Gorelik and Arnold Osipov show how they turned two patches for Outlook issues back into vulnerabilities! First, the focus is Outlook custom forms — a feature allowing creation of tailored messages in emails. Under the hood, forms are COM objects, defining a new form type means creating a config file for it, with a value copied to the registry specifying the COM server handler for it. So, what if we make the key point at some DLL that we control? That's immediately RCE! To block this, Outlook uses a denylist that filters out registry keys allowing RCE like `inprocserver32`, `localserver`, etc. A vulnerability from earlier this year found the denylist matching fails if you specify an absolute path rather than a relative path (so a `\CLSID\...\inprocserver32=` is a-okay!). This allows hijacking any COM object in the registry. Luckily, this vulnerability has been patched. But, remember the premise of the talk? The patch disallowed starting the path with a backslash. So what did Michael and Arnold do? Add a backslash at the end! This works because `RegCreateKeyExA` deletes the last backslash in the path. However, this happens *after* the denylist check, which passes and so we have a vulnerability! Second, the talk looks at Outlook Moniker objects—those are "smart links" in Outlook, allowing you to send emails embedding special links like Ca lender invites, Excel files, etc. Being simple pointers, it is possible for malicious actors to send emails with references to remote files, potentially leaking NTLM credentials if the user clicks them. Fortunately, Outlook blocks these links. *Unfortunately*, earlier this year it was found that if you add an exclamation mark (!) at the end of the link, Outlook blocking won't work. The reason is a bit complicated, but in short—the link is being treated as a special kind of Moniker, triggering a different flow composed of a few functions, which are vulnerable to remote file access. This vulnerability was patched by installing a hook on a certain vulnerable function at the end of the flow. The hook checks if a certain flag is set, and if so, blocks the call. The flag is set at the beginning of a function earlier in the flow. So only when the two functions are chained, the call is blocked. Notice the issue? If another Moniker flow eventually reaches the vulnerable function without passing through the first one, the flag isn't set and the patch won't work! Indeed, the researchers discovered such a flow—a link within an image tag instead of a hyperlink While a bit convoluted for someone who hasn't touched COM objects for at least a decade, this is still an eye-opening talk on the possibility of finding vulnerabilities in patches. youtu.be/GwwxeY11xMI #DEFCON #Vulnerability #Outlook

22

3 תגובות

** Thank you all for your insights on our latest research. We're currently revising the blog post and adding further clarification and any missing information based on feedback from the community and our latest review*** 🚨 Dear Security Engineers / AppSec people Uri Aronovici discovered a new attack where threat actors can exploit widely-used external Terraform providers to gain full control of a cloud production environment. Why you should care about it ? 📍 Most SAST / SDLC processes are not catching it 📍 There are many ways to exploit it 📍 There are few ways to detect it while it happens #terraform #cloudsecurity #appsec #riskmanagement

86

22 תגובות

Here's a live demo I gave a few weeks back on how Myrror Security would detect the XZ attack: Mandy Andress | Gidi Farkash

79

2 תגובות

Great information, Here are few more: - Having Compliance-Driven Priorities (focusing too much on non-technical aspect of security) - Absence of Remediation Framework (not knowing what to do after getting the vulnerabilities detected) - Lack of Vulnerability Management (Knowing what to do with vulnerabilities, but not being able to drive a system to keep it running for a really long time)

9

Are you confident in your network's defenses? Our latest guide walks you through a detailed checklist for network penetration testing, ensuring you leave no stone unturned in identifying vulnerabilities. From pre-testing preparations to post-exploitation analysis, this checklist is your roadmap to a secure network. How do you ensure your network remains secure against evolving threats? 👉https://lnkd.in/gEDW3hJ3

3

I am thrilled to share that I have been recognized as one of the top contributors in the CVE category of Israel National Cyber Directorate - מערך הסייבר הלאומי for June. This is also a good time to remind everyone: If you find a vulnerability (whether it's a 0-day or a 1-day) in an Israeli digital asset exposed to the internet, there's one address to report it to help us protect the country in the cyber realm: 119@cyber.gov.il

26

5 תגובות