CVE-2024-21410, identified as an elevation of privilege flaw within Microsoft Exchange Server, warrants immediate attention for patching. However, addressing this vulnerability fully may pose challenges as it necessitates additional administrative actions.
Exploiting CVE-2024-21410 could potentially lead to the exposure of NTLM credentials belonging to a targeted user. These credentials could then be exploited in NTLM relay or pass-the-hash attacks, enabling the attacker to authenticate as the targeted user. Satnam Narang, senior staff research engineer at Tenable, emphasizes the value of flaws like these to attackers, citing a similar vulnerability (CVE-2023-23397) exploited by a Russian-based threat actor.
Additionally, CVE-2024-21413 presents a remote code execution vulnerability affecting Microsoft Office. This vulnerability could allow attackers to circumvent the Office Protected View and open a file in editing mode, potentially enabling code execution. Of particular concern is the possibility of code execution occurring within the Preview Pane.
Addressing CVE-2024-21413 requires users of both the 32- and 64-bit versions of Office 2016 to install multiple updates to fully mitigate the vulnerability.
