Outlook Unleashing RCE Chaos: CVE-2024-30103
Technical breakdown and exploitation of CVE-2024-30103, allowing zero-click and one-click remote code execution via Microsoft Outlook.
Summary
Outlook Attack Surface and COM Objects
Did you ever receive an empty email and immediately think it might be a reconnaissance attack? What if opening such an email in your Outlook client could trigger remote code execution through an invisible form? Yes, all forms are COM objects, and CVE-2024-21378 has flung open the gates to Outlook RCE chaos.
Discovery and Root Cause of CVE 2024 30103
In our session, "Outlook Unleashing RCE Chaos: CVE-2024-30103" we'll dive into how this seemingly innocuous vulnerability can lead to mayhem. This vulnerability paved the way for us to discover a series of new remote code execution vulnerabilities in Outlook, including CVE-2024-30103. But we’re not stopping there.
Triggering Remote Code Execution
Additionally, we'll uncover other vulnerabilities that can cause NTLM leaks from your domain-joined devices.
So, how did we get here? Join us as we construct an evolution timeline of this attack surface. From the origins of these exploits to their current incarnations, we'll cover it all. And because we believe in building a safer digital world, we'll conclude with specific, actionable recommendations on how to minimize these threats.
Related talks
Main Stage·35 min
Ji'an Zhou · Lishuo Song
Discloses multiple memory corruption and deserialization vulnerabilities in PyTorch's TorchScript JIT engine that allow arbitrary remote code execution via malicious AI models.
Main Stage·34 min
Ji'an Zhou · Ying Zhu · ZiYang Li
Reveals critical architectural and deserialization vulnerabilities across Apache Kafka client and server implementations, enabling remote code execution.
Main Stage·39 min
Anna Antonenko
Demonstrates remote code execution across audio software and operating system synthesis engines by weaponizing malformed MIDI protocol messages.