I don't see why a possibility for chaining this with an old, already patched RCE would suffice for qualifying as RCE itself. I mean, @xaitax video shows coupling with Follina (CVE-2022-30190), and couples it with CVE-2023-21716. I think there must be more than that there.github.com/labesterOct/CV…
@HaifeiLi @xaitax Besides, parsing of this "!" format must be insane: Exclamation mark is a valid character in a file name. How would you go about parsing that? My money is on this parsing being broken and exploitable.
Well, well, well. You try to see if function ole32!MkParseDisplayName was patched by February updates - but ole32.dll hasn't changed at all! So the function wasn't patched, right?
Then you put a breakpoint on this function in Outlook process and - HELLO, Microsoft! The function is hotpatched and, with a jmp instruction written over the first bytes, replaced with its alternative in mso.dll.
This is what we at @0patch have been doing (albeit more "surgically" modifying just a part of a function) for 9 years now, and it's nice to see Microsoft finally joining the party on on-prem Windows.
Then you put a breakpoint on this function in Outlook process and - HELLO, Microsoft! The function is hotpatched and, with a jmp instruction written over the first bytes, replaced with its alternative in mso.dll.
This is what we at @0patch have been doing (albeit more "surgically" modifying just a part of a function) for 9 years now, and it's nice to see Microsoft finally joining the party on on-prem Windows.
However, this is bad news for patch analysis. Simply diffing two consecutive EXE/DLL versions no longer gives one a reliable list of changes in said EXE/DLL. With the CVE-2024-21413 patch Outlook self-patches ole32.dll loaded in its process and replaces original function ole32!MkParseDisplayName with its own function. Diffing ole32.dll does not reveal that.
@HaifeiLi @xaitax Interestingly, this "!" trick has been used before in a CVE-2021-40444 exploit as noticed by @wdormann back in 2021
https://x.com/wdormann/status/1443566732694654984?s=20
• • •
Missing some Tweet in this thread? You can try to
force a refresh
