CVE-2024-21413: 
vulnerability analysis and mitigation

Microsoft Outlook Remote Code Execution Vulnerability (CVE-2024-21413) is a critical security flaw discovered by Check Point vulnerability researcher Haifei Li. The vulnerability stems from improper input validation when opening emails with malicious links in vulnerable Outlook versions. The flaw affects multiple Office products, including Microsoft Office LTSC 2021, Microsoft 365 Apps for Enterprise, Microsoft Outlook 2016, and Microsoft Office 2019 (Bleeping Computer).

The vulnerability, dubbed 'Moniker Link', allows attackers to bypass built-in Outlook protections for malicious links embedded in emails using the file:// protocol and by adding an exclamation mark to URLs pointing to attacker-controlled servers. The flaw enables attackers to bypass Protected View, which normally blocks harmful content by opening files in read-only mode. The vulnerability received a CVSS score of 9.8, indicating its critical severity. The attack can be triggered even when previewing maliciously crafted Office documents in the Preview Pane (Check Point Research).

Successful exploitation of CVE-2024-21413 can result in remote code execution and theft of NTLM credentials via maliciously crafted Office documents. The vulnerability allows attackers to bypass Office Protected View when targeting other Office applications, making it particularly dangerous. The attack vector requires only a single click from the user, making it more effective than traditional attack methods that require multiple user interactions (Check Point Research).

Microsoft has released a critical Security Update for Outlook on the February 2024 Patch Tuesday to address this vulnerability. Organizations are strongly recommended to apply the official patch as soon as possible. Check Point has developed various protections for their customers, including Email Security protection deployed since October 25, 2023, and an IPS Protection named 'Microsoft Outlook Malicious Moniker Link Remote Code Execution' (Check Point Research).