CVE-2023-35311: Microsoft 365 Apps Auth Bypass Vulnerability

CVE-2023-35311 Overview

CVE-2023-35311 is a security feature bypass vulnerability affecting Microsoft Outlook that allows attackers to circumvent critical security warnings designed to protect users from malicious content. This vulnerability has been actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating significant real-world threat activity.

The vulnerability is classified as CWE-367 (Time-of-Check Time-of-Use Race Condition), which involves a timing flaw where security checks can be bypassed between the time a resource is verified and the time it is actually used. This type of vulnerability is particularly dangerous in email clients where security prompts serve as a critical last line of defense against phishing and malware delivery.

Critical Impact

This vulnerability allows attackers to bypass Outlook security feature warnings, potentially enabling malicious content to execute without user awareness. Active exploitation has been confirmed in the wild.

Affected Products

• Microsoft 365 Apps (Enterprise)
• Microsoft Office 2019
• Microsoft Office Long Term Servicing Channel 2021
• Microsoft Outlook 2013 (including SP1 RT)
• Microsoft Outlook 2016

Discovery Timeline

• 2023-07-11 - CVE-2023-35311 published to NVD
• 2025-10-28 - Last updated in NVD database

Technical Details for CVE-2023-35311

Vulnerability Analysis

This security feature bypass vulnerability exists in how Microsoft Outlook handles security prompts for potentially dangerous content. The flaw stems from a Time-of-Check Time-of-Use (TOCTOU) race condition, where the security state can change between when Outlook verifies that a warning should be displayed and when the content is actually processed.

In normal operation, Outlook displays security warnings when users attempt to open potentially malicious links or attachments. This vulnerability allows attackers to craft content that exploits the timing window in this security mechanism, effectively suppressing these critical warnings without the user's knowledge.

The attack requires user interaction but operates over the network, meaning attackers can deliver malicious emails or calendar invitations remotely. The complexity of exploitation is relatively high due to the race condition timing requirements, but successful exploitation can lead to complete compromise of confidentiality, integrity, and availability on the affected system.

Root Cause

The root cause of CVE-2023-35311 is a Time-of-Check Time-of-Use (TOCTOU) race condition in Microsoft Outlook's security feature implementation. This occurs when there is a temporal gap between the security validation check and the actual execution of the action. During this window, an attacker can manipulate conditions to bypass the intended security prompt, allowing potentially malicious operations to proceed without appropriate user warnings.

Attack Vector

The attack vector for CVE-2023-35311 is network-based, typically through specially crafted emails, calendar invitations, or other Outlook-handled content. An attacker can exploit this vulnerability by:

1. Crafting malicious content designed to exploit the TOCTOU race condition
2. Delivering the payload to victims via email or other Outlook-supported protocols
3. When the victim interacts with the content, the race condition allows security warnings to be bypassed
4. Malicious actions execute without the expected security prompts alerting the user

The vulnerability requires user interaction to trigger, but the bypass of security warnings significantly increases the likelihood of successful attacks since users may not realize they are interacting with dangerous content.

Detection Methods for CVE-2023-35311

Indicators of Compromise

• Unusual Outlook process behavior or unexpected child processes spawned from OUTLOOK.EXE
• Email messages or calendar invitations with suspicious attachment types or embedded links that execute without displaying expected security dialogs
• Anomalous network connections originating from Outlook to unknown or malicious domains
• Event log entries indicating Outlook security feature anomalies or suppressed warnings

Detection Strategies

• Monitor for Outlook processes that spawn unexpected child processes, particularly cmd.exe, powershell.exe, or script interpreters
• Implement email gateway rules to flag or quarantine messages with characteristics commonly associated with this exploitation technique
• Deploy endpoint detection rules to identify Outlook behavior patterns consistent with security feature bypass
• Enable and monitor Windows Security event logs for application anomalies related to Microsoft Office products

Monitoring Recommendations

• Enable enhanced logging for Microsoft Office applications and review logs regularly for suspicious activity
• Implement behavioral monitoring on endpoints to detect when Outlook performs actions without corresponding security prompt displays
• Configure SIEM alerts for patterns of Outlook-initiated network connections to newly observed or low-reputation domains
• Monitor for bulk email delivery attempts that may indicate phishing campaigns targeting this vulnerability

How to Mitigate CVE-2023-35311

Immediate Actions Required

• Apply the latest Microsoft security updates for all affected Outlook and Office products immediately
• Review and enforce email security policies to block or quarantine suspicious attachments and links
• Enable Protected View and Attack Surface Reduction (ASR) rules for Microsoft Office applications
• Educate users about the risks of opening unexpected attachments or clicking links in emails, even if security prompts do not appear

Patch Information

Microsoft has released security updates to address CVE-2023-35311. Organizations should apply the patches detailed in the Microsoft Security Update Guide for CVE-2023-35311. Given that this vulnerability is actively exploited and listed in the CISA Known Exploited Vulnerabilities Catalog, federal agencies and organizations following CISA guidance are required to remediate within specified timelines.

Ensure all Microsoft Outlook versions including Outlook 2013, Outlook 2016, Office 2019, Office LTSC 2021, and Microsoft 365 Apps are updated to the latest patched versions.

Workarounds

• If immediate patching is not possible, consider temporarily restricting email attachment types and link access in Outlook
• Implement network-level email scanning and filtering to detect and block malicious content before it reaches end users
• Use application whitelisting to prevent unauthorized processes from being spawned by Outlook
• Consider temporarily disabling preview pane functionality to reduce attack surface while awaiting patch deployment

# Configuration example - Enable Attack Surface Reduction rules for Office applications
# Run in elevated PowerShell to enable ASR rules that block Office from creating child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Block Office applications from creating executable content
Add-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 -AttackSurfaceReductionRules_Actions Enabled