CVE-2024-38200
published 2024-08-08CVE-2024-38200: Microsoft Office Spoofing Vulnerability Microsoft Office Spoofing Vulnerability
critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EXPLOIT
EPSS
20.30%
97.2th percentile
Microsoft Office Spoofing Vulnerability
Microsoft Office Spoofing Vulnerability
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_365_apps_for_enterprise | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_2016 | >= 16.0.0 < 16.0.5461.1001 | 16.0.5461.1001 |
| microsoft | microsoft_office_2019 | >= 19.0.0 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_ltsc_2021 | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| msrc | microsoft_365_apps_for_enterprise_for_32-bit_systems | — | — |
| msrc | microsoft_365_apps_for_enterprise_for_64-bit_systems | — | — |
| msrc | microsoft_office_2016 | — | — |
| msrc | microsoft_office_2019_for_32-bit_editions | — | — |
| msrc | microsoft_office_2019_for_64-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2021_for_32-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2021_for_64-bit_editions | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Microsoft Office Spoofing to HTTP Redirect Inbound (CVE-2024-38200)"; flow:established,to_client; http.content_type; pcre:"/^(?:application\x2fjavascript|text\x2fhtml)$/"; http.response_body; content:"|7c|u|7c|http"; fast_pattern; pcre:"/ms-(?:word|powerpoint|excel|visio|access|project|publisher|spd|infopath)\x3a(?:of(?:e|v)|nft)\x7cu\x7chttps?\x3a\x2f{2}/i"; content:!"|2e|office|2e|net|2f|"; reference:url,github.com/passtheticket/CVE-2024-38200; reference:cve,2024-38200; classtype:bad-unknown; sid:2056375; rev:1; metadata:affected_product MS_Office, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2024_10_01, cve CVE_2024_38200, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, updated_at 2024_10_01; target:dest_ip;)- →Detect inbound HTTP responses containing MS Office URI scheme redirects (ms-word, ms-excel, ms-powerpoint, etc.) with the ofe|u| or nft|u| pattern pointing to non-office.net URLs — the Snort/ET rule (sid:2056375) matches on content '|7c|u|7c|http' combined with the URI scheme PCRE and absence of '.office.net/'. ↗
- →Monitor for outbound NTLM authentication (SMB/HTTP) triggered by Office URI scheme invocations (ms-word:, ms-excel:, etc.) to non-Microsoft hosts, which indicates forced NTLMv2 hash capture. ↗
- →Alert on outbound TCP 445 (SMB) connections from workstations to external/untrusted IPs, which may indicate NTLM hash leakage triggered by a malicious Office URI. ↗
- →Audit or block outgoing NTLM traffic to remote servers using the 'Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers' group policy; unexpected NTLM attempts to external hosts may indicate exploitation. ↗
- →Watch for DNS A record creation by standard domain users (e.g., via dnstool.py) pointing to attacker-controlled IPs, which is a prerequisite step in the exploit chain to trigger automatic NTLMv2 authentication via Intranet Zone trust. ↗
- →Monitor ntlmrelayx activity relaying captured NTLMv2 hashes to LDAP on domain controllers (port 389), which is the post-capture escalation step in the CVE-2024-38200 exploit chain. ↗
- ·The ET Snort rule (sid:2056375) requires TLS decryption to be effective against HTTPS-delivered payloads, as indicated by the 'tls_state TLSDecrypt' and 'deployment SSLDecrypt' metadata tags. ↗
- ·Blocking outbound NTLM traffic or TCP 445 may break legitimate access to remote servers and applications that rely on NTLM authentication — validate impact before enforcing. ↗
- ·Adding users to the Protected Users Security Group prevents NTLM use but may impact applications requiring NTLM; settings revert once the user is removed from the group. ↗
- ·A Feature Flighting fix was deployed on 7/30/2024 protecting in-support Office/M365 versions, but the final patch requires the August 13, 2024 update to be fully remediated. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
cvelistv56.5MEDIUM
vendor_msrc6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Microsoft Office Spoofing Vulnerability
vendor_msrc·2024-08-13·CVSS 6.5
CVE-2024-38200 [MEDIUM] CWE-200 Microsoft Office Spoofing Vulnerability
Microsoft Office Spoofing Vulnerability
FAQ: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.
FAQ: Am I vulnerable to this issue until I install the August 13, 2024 updates?
No, we identified an alternative fix to thi
CVEList
Microsoft Office Spoofing Vulnerability
cvelistv5·2024-08-08·CVSS 6.5
CVE-2024-38200 [MEDIUM] CWE-200 Microsoft Office Spoofing Vulnerability
Microsoft Office Spoofing Vulnerability
Microsoft Office Spoofing Vulnerability
Suricata
ET EXPLOIT Microsoft Office Spoofing to HTTP Redirect Inbound (CVE-2024-38200)
suricata·2024-10-01·CVSS 6.5
CVE-2024-38200 [MEDIUM] ET EXPLOIT Microsoft Office Spoofing to HTTP Redirect Inbound (CVE-2024-38200)
ET EXPLOIT Microsoft Office Spoofing to HTTP Redirect Inbound (CVE-2024-38200)
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Microsoft Office Spoofing to HTTP Redirect Inbound (CVE-2024-38200)"; flow:established,to_client; http.content_type; pcre:"/^(?:application\x2fjavascript|text\x2fhtml)$/"; http.response_body; content:"|7c|u|7c|http"; fast_pattern; pcre:"/ms-(?:word|powerpoint|excel|visio|access|project|publisher|spd|infopath)\x3a(?:of(?:e|v)|nft)\x7cu\x7chttps?\x3a\x2f{2}/i"; content:!"|2e|office|2e|net|2f|"; reference:url,github.com/passtheticket/CVE-2024-38200; reference:cve,2024-38200; classtype:bad-unknown; sid:2056375; rev:1; metadata:affected_product MS_Office, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2024_10_01, cve CVE_2024_38200
Talos
AI, election security headline discussions at Black Hat and DEF CON
blogs_talos·2024-08-15
AI, election security headline discussions at Black Hat and DEF CON
As promised, I’m back this week to recap some of the top stories coming out of Black Hat and DEF CON.
Also as promised, AI was the talk of Vegas during Hacker Summer Camp (or at least from what I’ve been reading and hearing, I wasn’t there in person).
Several exhibitions and talks at both conferences showed how easy it is to create deepfake videos and potentially use them to spread fake news and disinformation. Two security researchers worked to deepfake themselves and even managed to trick people into believing it really was them on one end of a video conference call.
Others on the show floor had the opportunity to try their hand at creating deepfakes with the help of the Defense Advanced Research Projects Agency (DARPA). One standout example was a fake video of former Royal Family mem
Talos
AI, election security headline discussions at Black Hat and DEF CON
blogs_talos·2024-08-15
AI, election security headline discussions at Black Hat and DEF CON
## AI, election security headline discussions at Black Hat and DEF CON
As promised, I’m back this week to recap some of the top stories coming out of Black Hat and DEF CON.
Also as promised, AI was the talk of Vegas during Hacker Summer Camp (or at least from what I’ve been reading and hearing, I wasn’t there in person).
Several exhibitions and talks at both conferences showed how easy it is to create deepfake videos and potentially use them to spread fake news and disinformation. Two security researchers worked to deepfake themselves and even managed to trick people into believing it really was them on one end of a video conference call.
Others on the show floor had the opportunity to try their hand at creating deepfakes with the help of the Defense Advanced Research Projects Agency (
Trendmicro
The August 2024 Security Update Review
blogs_trendmicro·2024-08-13·CVSS 6.7
[MEDIUM] The August 2024 Security Update Review
## The August 2024 Security Update Review
Get the August 2024 security update and review.
By: Dustin Childs 2024/08/13 Read time: ( words)
Save to Folio
I have successfully survived Summer Hacker Camp, and I hope you have too. And we return just in time for Patch Tuesday and a new crop of 0-days as Microsoft and Adobe have released their regularly scheduled updates. Take a break from your regular activities and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering the entire release, you can check it out here:
CVE
Title
Severity
CVSS
Public
Exploited
Type
CVE-2024-38189
Microsoft Project Remote Code Execution Vulnerability
Important
8.8
No
Yes
RCE
CVE-2024-38178
Scripting Engine Memory Corruption Vulnerabil
Qualys
Microsoft and Adobe Patch Tuesday, August 2024 Security Update Review
blogs_qualys·2024-08-13·CVSS 6.7
[MEDIUM] Microsoft and Adobe Patch Tuesday, August 2024 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for August 2024
Adobe Patches for August 2024
Zero-day Vulnerabilities Patched in August Patch Tuesday Edition
Critical Severity Vulnerabilities Patched in August Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
Qualys Monthly Webinar Series
Microsoft’s August Patch Tuesday updates are out, and they address a range of vulnerabilities across multiple products. Let’s dive into the key updates and their implications.
## Microsoft Patch Tuesday for August 2024
Microsoft Patch’s Tuesday, August 202
Tenable
Microsoft’s August 2024 Patch Tuesday Addresses 88 CVEs
blogs_tenable·2024-08-13
Microsoft’s August 2024 Patch Tuesday Addresses 88 CVEs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Microsoft & Adobe August 2024 Patch Tuesday Updates | Qualys
blogs_qualys·2024-08-13·CVSS 6.7
[MEDIUM] Microsoft & Adobe August 2024 Patch Tuesday Updates | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for August 2024
- Adobe Patches for August 2024
- Zero-day Vulnerabilities Patched in August Patch Tuesday Edition
- Critical Severity Vulnerabilities Patched in August Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- Qualys Monthly Webinar Series
Microsoft’s August Patch Tuesday updates are out, and they address a range of vulnerabilities across multiple products. Let’s dive into the key updates and their implications.
## Microsoft Patch Tuesday for August 2024
Microsoft Patch’s Tuesda
Bleepingcomputer
Microsoft August 2024 Patch Tuesday fixes 9 zero-days, 6 exploited
blogs_bleepingcomputer·2024-08-13·CVSS 7.5
[HIGH] Microsoft August 2024 Patch Tuesday fixes 9 zero-days, 6 exploited
## Microsoft August 2024 Patch Tuesday fixes 9 zero-days, 6 exploited
## Lawrence Abrams
36 Elevation of Privilege Vulnerabilities
4 Security Feature Bypass Vulnerabilities
28 Remote Code Execution Vulnerabilities
8 Information Disclosure Vulnerabilities
6 Denial of Service Vulnerabilities
7 Spoofing Vulnerabilities
The number of bugs listed above do not include Microsoft Edge flaws that were disclosed earlier this month.
To learn more about the non-security updates released today, you can review our dedicated articles on the new Windows 11 KB5041585 update and Windows 10 KB5041580 update .
## Ten zero-days disclosed
This month's Patch Tuesday fixes six actively exploited and three other publicly disclosed zero-day vulnerabilities. Another publicly disclosed zero-day remains unf
Trendmicro
The August 2024 Security Update Review
blogs_trendmicro·2024-08-13
The August 2024 Security Update Review
# The August 2024 Security Update Review
Get the August 2024 security update and review.
By: Dustin Childs
2024/08/13
Read time: ( words)
Save to Folio
I have successfully survived Summer Hacker Camp, and I hope you have too. And we return just in time for Patch Tuesday and a new crop of 0-days as Microsoft and Adobe have released their regularly scheduled updates. Take a break from your regular activities and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering the entire release, you can check it out here:
Adobe Patches for August 2024
For August, Adobe released 11 security bulletins addressing 71 CVEs in Adobe Illustrator. Dimension, Photoshop, InDesign, Acrobat and Reader, Bridge, Substance 3D Stager, Commerce, InC
Bleepingcomputer
Microsoft discloses unpatched Office flaw that exposes NTLM hashes
blogs_bleepingcomputer·2024-08-09·CVSS 6.5
CVE-2024-38200 [MEDIUM] Microsoft discloses unpatched Office flaw that exposes NTLM hashes
## Microsoft discloses unpatched Office flaw that exposes NTLM hashes
## Sergiu Gatlan
It impacts multiple 32-bit and 64-bit Office versions, including Office 2016, Office 2019, Office LTSC 2021, and Microsoft 365 Apps for Enterprise.
Even though Microsoft's exploitability assessment says that exploitation of CVE-2024-38200 is less likely, MITRE has tagged the likelihood of exploitation for this type of weakness as highly probable.
"In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability," Microsoft's advisory explains.
"However, an attacker would have no way to force the user to visit the website. Instead, an att
2024-08-08
Published