JasonT

A little info obtained from patch diffing and root cause analysis on CVE-2024-30103 Microsoft Outlook RCE: - It requires valid credentials of the target user to exploit. This is important to know because there is a lot of posting calling this a 'zero-click' exploit and while it might be true to an extent, you still need to be able to create a Form in the target users Outlook client, which requires authorization. - It's a bypass for a previously patched vulnerability (CVE-2024-21378) - Indicators of exploitation may include a suspicious DLL loaded in the Outlook.exe process, suspicious outbound connections from Outlook.exe and spawned child processes. Exploitation is less likely at a large scale given that an attacker would need a user's credentials to set the attack up. Applying the latest patches is the best way to defend against this exploit.