Microsoft March 2023 Patch Tuesday fixes 2 zero-days, 83 flaws

CVE-2023-23397 - Microsoft Outlook Elevation of Privilege Vulnerability

Microsoft has fixed a Microsoft Outlook privilege elevation bug that allows specially crafted emails to force a target's device to connect to a remote URL and transmit the Windows account's Net-NTLMv2 hash.

"External attackers could send specially crafted emails that will cause a connection from the victim to an external UNC location of attackers' control. This will leak the Net-NTLMv2 hash of the victim to the attacker who can then relay this to another service and authenticate as the victim.," reads Microsoft's advisory.

Microsoft warns that this flaw will be triggered before it is read in the preview pane as the vulnerability "triggers automatically when it is retrieved and processed by the email server."

In a private threat analytics report seen by BleepingComputer, Microsoft says that this Outlook vulnerability was exploited by STRONTIUM, a state-sponsored Russian hacking group.

Using this vulnerability, the threat actors gathered target's NTLM hashes to breach the victims' networks, where the threat actors stole emails for specific accounts.

This vulnerability was disclosed by CERT-UA, Microsoft Incident, Microsoft Threat Intelligence (MSTI).

CVE-2023-24880 - Windows SmartScreen Security Feature Bypass Vulnerability

Microsoft has fixed an actively exploited zero-day vulnerability in Windows SmartScreen that can be used to create executables that bypass the Windows Mark of the Web security warning.

"An attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging," reads Microsoft's advisory.

This vulnerability was discovered by Google’s Threat Analysis Group, who spotted it being exploited by the Magniber ransomware operation.

After analyzing the vulnerability, Google TAG determined that it was a bypass to a previous CVE-2022-44698 zero-day exploited by Magniber and fixed by Microsoft in December.

When exploiting the CVE-2022-44698, the threat actors utilized stand-alone, signed JavaScript (.JS) files with a malformed signature. This flaw caused Windows SmartScreen to generate an error and bypass the MoTW warnings.

After Microsoft fixed CVE-2022-44698 in December, Google found that the Magniber operation switched to using malformed authenticode signatures in MSI files to bypass the fix.

Google explained that this bypass was caused by Microsoft fixing only the initially reported JavaScript file abuse rather than fixing the root cause of the bug.

Microsoft says that the vulnerability was disclosed by Benoît Sevens and Vlad Stolyarov of Google’s Threat Analysis Group and Bill Demirkapi of Microsoft.