Microsoft has disclosed a high-severity zero-day vulnerability affecting several Office and 365 Enterprise products, for which a patch is still in development.
The vulnerability tracked as CVE-2024-38200 is caused by an information disclosure weakness that hackers can easily exploit to steal private and protected data from individuals or organizations, including system status and environment or configuration data, network status and configuration data, or connection metadata.
The zero-day vulnerability (CVE-2024-38200) affects the following products:
- Microsoft Office 2016 (32-bit & 64-bit)
- Microsoft Office 2019 (32-bit & 64-bit)
- Microsoft Office LTSC 2021 (32-bit & 64-bit)
- Microsoft 365 Apps for Enterprise (32-bit & 64-bit)
According to Microsoft’s exploitability assessment, the probability of exploiting CVE-2024-38200 is “less likely,” but MITRE has suggested that the chances of exploitation for this type of weakness are high.
“In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability,” Microosoft’s advisory explains.
“However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.”
Currently, Microsoft is developing security updates to address this zero-day vulnerability, but it has yet to announce a release date.
Microsoft has attributed the discovery of CVE-2024-38200 to Jim Rush, a security consultant at PrivSec Consulting, and Metin Yunus Kandemir, a member of the Synack Red Team.
More information about this vulnerability will be provided by Rush in his upcoming Defcon talk titled “NTLM – The last ride”, Peter Jakowetz, Managing Director at PrivSec told BleepingComputer.
“There will be a deep dive on several new bugs we disclosed to Microsoft (including bypassing a fix to an existing CVE), some interesting and useful techniques, combining techniques from multiple bug classes resulting in some unexpected discoveries and some absolutely cooked bugs. We’ll also uncover some defaults that simply shouldn’t exist in sensible libraries or applications as well as some glaring gaps in some of the Microsoft NTLM related security controls,” Rush explains.
Additionally, Microsoft is also working on addressing zero-day flaws that could force fully up-to-date software to revert to an older version with known, exploitable vulnerabilities.
Earlier this week, the company also announced that it is working on fixing a Windows Smart App Control, SmartScreen bypass that has been exploited in the wild since 2018.
