CVE-2024-38020: Microsoft Outlook Spoofing Vulnerability

CVE-2024-38020 Overview

CVE-2024-38020 is a spoofing vulnerability in Microsoft Outlook that allows an attacker to bypass identity verification controls when a user opens a specially crafted email. The flaw is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor) and affects multiple Microsoft Office and Outlook builds. Exploitation requires user interaction and network delivery of the malicious message. Successful attacks can leak sensitive information such as NTLM authentication material to attacker-controlled hosts, enabling downstream credential relay or offline cracking.

Critical Impact
An attacker who tricks a user into opening a crafted email can spoof trusted content and coerce Outlook into disclosing sensitive authentication data across the network.

Affected Products

Microsoft 365 Apps (Enterprise)
Microsoft Office 2016 and Office 2019
Microsoft Office Long Term Servicing Channel 2021
Microsoft Outlook 2016

Discovery Timeline

2024-07-09 - CVE-2024-38020 published to the National Vulnerability Database (NVD)
2024-07-09 - Microsoft publishes security update guidance for CVE-2024-38020
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38020

Vulnerability Analysis

CVE-2024-38020 is a spoofing weakness in how Microsoft Outlook processes inbound email content. The flaw allows an attacker to present content that appears to originate from a trusted source, bypassing Outlook's protective checks. Because the vulnerability maps to [CWE-200], the primary impact is unauthorized disclosure of sensitive information rather than code execution. Attackers commonly abuse Outlook spoofing bugs to elicit outbound authentication requests to attacker-controlled infrastructure. The exposed material can include NTLM hashes usable for relay attacks against internal services. Exploitation requires user interaction, typically previewing or opening the crafted message. No authentication is required by the attacker to deliver the malicious email over the network.

Root Cause

The issue stems from insufficient validation of message content and resource references processed by Outlook. When Outlook resolves attacker-influenced references, it discloses information the client should have suppressed. The result is exposure of sensitive data to an unauthorized actor, consistent with [CWE-200].

Attack Vector

Delivery occurs through a crafted email sent to the target mailbox. The victim triggers the flaw by interacting with the message inside Outlook. No elevated privileges are required, and the attack traverses standard mail transport paths. See the Microsoft Security Update guidance for CVE-2024-38020 for vendor technical details.

Detection Methods for CVE-2024-38020

Indicators of Compromise

Outbound SMB or WebDAV connections from Outlook client processes (OUTLOOK.EXE) to untrusted external hosts shortly after message receipt.
Unexpected NTLM authentication attempts originating from user workstations toward internet-facing endpoints.
Inbound emails containing references to remote UNC paths, remote images, or unusual embedded resource URIs.
Anomalous DNS lookups from mail clients for domains not associated with normal corporate correspondents.

Detection Strategies

Correlate mail gateway logs with endpoint telemetry to identify messages that trigger outbound authentication attempts from Outlook.
Hunt for OUTLOOK.EXE initiating TCP/445, TCP/139, or WebDAV traffic to destinations outside allowed ranges.
Inspect email content at the gateway for remote resource references such as \\attacker.example.com\share\image.png or file:// URIs.
Alert on NTLM authentication attempts leaving the network boundary through egress filtering appliances.

Monitoring Recommendations

Enable and centralize Microsoft 365 audit logs and endpoint process telemetry for mail-client behavior.
Monitor egress firewall logs for SMB, RPC, and WebDAV traffic destined for internet hosts.
Track patch compliance across all systems running affected Office and Outlook versions.
Review authentication logs for anomalous NTLM challenges tied to workstation IP addresses.

How to Mitigate CVE-2024-38020

Immediate Actions Required

Apply the Microsoft security updates for Microsoft 365 Apps, Office 2016, Office 2019, Office LTSC 2021, and Outlook 2016 as listed in the vendor advisory.
Block outbound SMB (TCP/445) and NetBIOS (TCP/139) traffic at the perimeter to prevent NTLM leakage to external hosts.
Prioritize patch deployment on mailbox users with elevated privileges or access to sensitive systems.
Validate that all managed endpoints have received the July 2024 Office cumulative updates.

Patch Information

Microsoft addressed CVE-2024-38020 in the July 2024 Patch Tuesday release. Apply the updates referenced in the Microsoft Security Update Guide for CVE-2024-38020. Update all Click-to-Run and MSI-based installations of Microsoft 365 Apps, Office 2016, Office 2019, Office LTSC 2021, and Outlook 2016 to the fixed builds documented by the vendor.

Workarounds

Enforce SMB signing and disable outbound NTLM authentication to internet destinations using Group Policy.
Configure Outlook to block automatic downloading of external content and remote images in email messages.
Restrict egress network traffic for mail-client processes to trusted destinations only.
Deploy email gateway rules that strip or neutralize remote resource references in inbound messages.

bash

# Configuration example: Block outbound NTLM to remote servers via Group Policy
# Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
# Policy: "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers"
# Recommended setting: Deny all

# Disable automatic external content download in Outlook (registry)
reg add "HKCU\Software\Microsoft\Office\16.0\Common\MailSettings" /v BlockExtContent /t REG_DWORD /d 1 /f