【CVE-2023-23397】Microsoft Outlook 安全漏洞
作者：Sec-Labs | 发布时间：
项目地址
https://github.com/sqrtZeroKnowledge/CVE-2023-23397_EXPLOIT_0DAY
漏洞分享
Microsoft Outlook是美国微软（Microsoft）公司的一套电子邮件应用程序。
Microsoft Outlook存在安全漏洞。以下产品和版本受到影响：Microsoft Office LTSC 2021 for 32-bit editions,Microsoft Outlook 2016 (32-bit edition),Microsoft Office LTSC 2021 for 64-bit editions,Microsoft 365 Apps for Enterprise for 64-bit Systems,Microsoft Office 2019 for 64-bit editions,Microsoft 365 Apps for Enterprise for 32-bit Systems,Microsoft Office 2019 for 32-bit editions,Microsoft Outlook 2013 Service Pack 1 (64-bit editions),Microsoft Outlook 2013 RT Service Pack 1,Microsoft Outlook 2013 Service Pack 1 (32-bit editions),Microsoft Outlook 2016 (64-bit edition)。
漏洞POC
CVE-2023-23397的漏洞 归功于domchell
EML/MSG Checker的漏洞
#!/usr/bin/env python3
from extract_msg import AppointmentMeeting
from ..helpers import Status
from ..task import Task
from ..report import Report
from .base import BaseWorker
class OutlookMSG(BaseWorker):
def analyse(self, task: Task, report: Report, manual_trigger: bool=False):
print(task.file.msg_data)
if not task.file.msg_data or not isinstance(task.file.msg_data, AppointmentMeeting):
report.status = Status.NOTAPPLICABLE
return
self.logger.debug(f'analysing AppontmentMeeting in {task.file.path}...')
if task.file.msg_data.reminderFileParameter is not None:
report.status = Status.ALERT
# suspicious for cve-2023-23397: https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/
report.add_details('CVE-2023-23397', f'A parameter used to exploit this vulnerability is present in the mail: "{task.file.msg_data.reminderFileParameter}"')标签：工具分享, 漏洞分享, POC脚本