💻 Microsoft Office NTLMv2 Disclosure (CVE-2024-38200)

A new vulnerability related to capturing NTLMv2 hashes via Office URI schemes has been discovered. The http:// protocol can be used for attacks such as NTLM relay to a Domain Controller.

Microsoft 365 and Office 2019 versions are vulnerable, as they open remote files without warnings, unlike earlier versions. The exploit involves using a 302 redirect and abusing GPO misconfigurations to capture NTLMv2 hashes over SMB and HTTP.

🔗 Source:
https://github.com/passtheticket/CVE-2024-38200

#windows #office #ntlm #relay