This month we got patches for 80 vulnerabilities. Of these, 5 are critical, and 2 are being exploited according to Microsoft.

One of the exploited vulnerabilities is the Internet Shortcut Files Security Feature Bypass Vulnerability (CVE-2024-21412). According to the advisory, an unauthenticated attacker could send the targeted user a specially crafted file that is designed to bypass displayed security checks. However, the attacker would have no way to force a user to view the attacker-controlled content. Instead, the attacker would have to convince them to take action by clicking on the file link. The CVSS for this vulnerability is 8.1.

The second exploited vulnerability is the Windows SmartScreen Security Feature Bypass Vulnerability (CVE-2024-21351). According to the advisory, the vulnerability allows a malicious actor to inject code into SmartScreen and potentially gain code execution, which could potentially lead to some data exposure, lack of system availability, or both.

About the critical vulnerabilities,one of them is the Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2024-21410). According to the advisory, an attacker who successfully exploited this vulnerability could relay a user's leaked Net-NTLMv2 hash against a vulnerable Exchange Server and authenticate as the user. The CVSS for this vulnerability is 9.8 – the highest for this month.

A second critical vulnerability worth mentioning is the Microsoft Outlook Remote Code Execution Vulnerability (CVE-2024-21413). Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode. An attacker could craft a malicious link that bypasses the Protected View Protocol, which leads to the leaking of local NTLM credential information and remote code execution (RCE). The CVSS for this vulnerability is 9.8 as well.

February 2024 Security Updates

--
Renato Marinho
Morphus Labs| LinkedIn|Twitter