Outlook Vulnerability

An exploit has been released for a cross site scripting vulnerability in Microsoft Outlook for Android. A flaw in the way Outlook parses emails can be abused in order to execute arbitrary code on victim device. A researcher from F5 labs has published a blog post containing technical details related to the vulnerability. Microsoft has released a patch for this exploit.

Recommendations

• Apply the patch for CVE-2019-1105 listed on the linked advisory.
• Consider enabling Cyber Attack Chatter in the platform to monitor chatter related to this vulnerability.

Details

On June 20, 2019, Microsoft disclosed a vulnerability in the email parsing mechanism of Outlook for Android, CVE-2019-1105. Successful exploitation of this could potentially allow for an attacker to conduct cross site scripting attacks on victim devices. At the time of Microsoft's advisory release, limited information regarding the vulnerability was available. However, over the weekend, a researcher at F5 Networks, Bryan Appleby, released a blog post containing a proof of concept of an exploit and further technical details.

In the post, Brian describes how Outlook for Android allows for iframes to be embedded in an email. This allows for JavaScript to be embedded in an email, and run directly on an affected device that receives an email exploiting this CVE. When an attacker sends a malicious email, the server escapes JavaScript that is contained within the iframe, so it is never seen. When a malicious email is received, the client unescapes the JavaScript, and runs it. Because of this, an attacker is able to leverage this vulnerability in order to execute arbitrary JavaScript on a victim device with ease.