Zero-click RCE vulnerability affects Microsoft Outlook applications

Morphisec researchers have discovered a critical zero-click remote code execution (RCE) vulnerability in Microsoft Outlook, designated CVE-2024-38021.

Unlike the previously disclosed CVE-2024-30103 vulnerability, this vulnerability does not require authentication, making it particularly dangerous.

This zero-click remote code execution (RCE) vulnerability poses a significant threat because it can be exploited without any user interaction, especially when emails are received from trusted senders.

CVE-2024-38021 may result in serious consequences, including data breaches, unauthorized access, and other malicious activities.

Join our free webinar to learn more about combating slow DDoS attacksa major threat today.

Details of vulnerability CVE-2024-38021

The CVE-2024-38021 vulnerability poses significant risks, including potential data breaches, unauthorized access, and other malicious activity. Microsoft has rated this vulnerability as “important,” noting that it requires no clicks for trusted senders, but requires one-click user interaction for untrusted senders.

Morphisec urged Microsoft to re-evaluate the severity of the issue to “Critical” due to the broader implications and potentially widespread impact.

Exploitation of CVE-2024-38021 is more complex than CVE-2024-30103, reducing the likelihood of immediate exploitation. However, if combined with another vulnerability, the attack process could be simplified, increasing the risk.

• April 21, 2024:Morphisec reported the vulnerability to Microsoft.
• April 26, 2024:Microsoft has confirmed the vulnerability.
• July 9, 2024:Microsoft has released a fix for CVE-2024-38021 as part of its Patch Tuesday updates.

The zero-click nature of CVE-2024-38021 for trusted senders and the lack of authentication requirements make it a serious threat.

Attackers could exploit this vulnerability to gain unauthorized access, execute arbitrary code, and cause significant damage without user interaction. This opens the door to widespread exploitation, highlighting the need for immediate mitigation.

Hotfix Released and Urgent Call for Action

To mitigate the risks associated with CVE-2024-38021, the following actions are recommended:

• Patch Deployment: Make sure all Microsoft Outlook and Office applications are updated with the latest patches.
• Email Security:Implement robust email security measures, including disabling automatic email previews if possible.
• User awareness: Educate users about the risks of opening emails from unknown or suspicious sources.

Microsoft’s rapid response to this vulnerability is commendable, especially given its problematic nature and the complexity of the previous patch. However, it is essential to re-evaluate the severity of the vulnerability to “Critical” to reflect the actual risk and ensure adequate attention and resources for mitigation.

"Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!"- Free Demo