PoC Released for Critical Outlook Zero-Click RCE Bug

A Proof‑of‑Concept exploit has been released for a critical remote code execution vulnerability in Microsoft Outlook, tracked as CVE‑2024‑21413.

The flaw, known as “MonikerLink,” allows attackers to bypass Outlook’s Protected View and execute malicious code or steal credentials. The PoC release highlights the continuing risk and provides security teams with insight into the attack vector.

Understanding the MonikerLink Flaw

This vulnerability, rated with a CVSS score of 9.8, originates from the way Outlook parses special hyperlinks called Moniker Links.

Protected View is designed to restrict suspicious files by running them in a limited, read‑only mode. However, attackers can bypass this protection by embedding a crafted file:// link containing an exclamation mark and additional text.

How the Exploit Triggers in Outlook

When a user clicks a malicious Moniker Link, Outlook attempts to access the referenced file without presenting any security warning.

This silent lookup can trigger an SMB connection to an attacker‑controlled server, resulting in the leakage of the victim’s NTLM credentials. In advanced attack scenarios, this behavior can escalate to remote code execution, giving attackers high‑level control over the compromised system.

The newly published Python-based PoC illustrates how this vulnerability can be exploited in a controlled lab setup. Available on GitHub, the script is designed to work with a specific configuration involving hMailServer and targets a user running a vulnerable version of Outlook.

It automates the process of sending an email that embeds the crafted Moniker Link, ensuring the malicious payload lands directly in the victim’s inbox.

According to the PoC author, the script assumes a simplified testing environment, including the absence of TLS authentication, to make the learning process easier. While the code is intentionally basic and aimed at users exploring the “MonikerLink” room on TryHackMe, it effectively demonstrates the core attack mechanics.

For researchers looking for more advanced tooling, the author also recommends alternative repositories, such as the one maintained by security researcher Xaitax.

Impact and Security Considerations

Beyond credential theft, the MonikerLink bypass can lead to full remote code execution when combined with other exploitation techniques.

This makes the flaw one of the most critical Outlook vulnerabilities disclosed in recent years. Organizations are urged to apply available patches and review email security controls to reduce exposure.

Mitigations:

• Watch for unusual email patterns that may indicate someone trying to trigger this weakness. A new YARA rule from researcher Florian Roth can help spot emails containing the file:\ path trick.
• Using this rule allows defenders to catch risky emails early, before they reach users.
• Microsoft has published security fixes for CVE-2024-21413, and updating systems right away is strongly recommended.
• Since exploit examples are now public, attackers are more likely to copy and use them.
• Make sure every Microsoft Office installation is running the latest security updates.
• Blocking outbound SMB connections on port 445 can help prevent NTLM credentials from leaking to outside servers.