CVE-2017-11774
Microsoft Office Outlook Security Feature Bypass Vulnerability
Description
CVE-2017-11774 is a high-severity security feature bypass vulnerability in Microsoft Outlook that allows an attacker to execute arbitrary commands. The vulnerability stems from how Microsoft Office improperly handles objects in memory, enabling attackers to bypass Outlook security restrictions and achieve code execution through the Outlook Home Page feature. This Microsoft Office vulnerability has been actively exploited by advanced threat actors and is listed in the CISA Known Exploited Vulnerabilities catalog. With an EPSS score of 82.85% (99.2nd percentile), CVE-2017-11774 remains a significant threat to organizations running unpatched Microsoft Outlook 2010, 2013, or 2016.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | outlook | 2010; 2013; 2016 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/101098(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1039542(Broken Link, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774(Patch, Vendor Advisory)
- https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11774(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Microsoft Outlook is affected by a buffer boundary vulnerability related to improper restriction of operations within memory buffer bounds. This weakness class encompasses situations where software performs operations on a memory buffer but can read from or write to memory locations outside the intended boundary, leading to memory corruption and potential code execution. In the context of CVE-2017-11774, the improper memory handling in Microsoft Office allows attackers to bypass Outlook’s security sandbox and execute arbitrary commands.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2017-11774 carries a CVSS 3.1 score of 7.8 (HIGH), representing a significant threat to organizations using affected Outlook versions. The vulnerability has a local attack vector — exploitation requires the user to interact with a malicious Outlook configuration — but the attack complexity is low, meaning no special conditions beyond social engineering are required. Confidentiality (High): Successful exploitation provides the attacker with full access to the user’s mailbox, credentials, and all data accessible within the user’s privilege context. Integrity (High): An attacker can execute arbitrary commands, modify data, install persistent access mechanisms, and alter Outlook configurations to maintain ongoing access. Availability (High): The vulnerability can be used to disrupt email services, deploy destructive payloads, or cause system instability through arbitrary command execution. The EPSS score of 82.85% indicates highly probable exploitation activity. The Outlook Home Page attack vector is particularly insidious because it can be configured remotely via Exchange rules, enabling persistent access even after the initial compromise vector is remediated.
Exploit Maturity
CVE-2017-11774 has been actively exploited by sophisticated threat actors, including state-sponsored groups, as confirmed by its listing in the CISA Known Exploited Vulnerabilities catalog. Public exploit details are available through SensePost’s research on the Outlook Home Page vector, which details how the Outlook Home Page feature can be abused to bypass security controls and execute arbitrary commands. The EPSS score of 82.85% (99.2nd percentile) indicates highly probable exploitation activity. This vulnerability is notable for its use by advanced persistent threat groups who leverage the Outlook Home Page feature as a persistent backdoor mechanism, configuring malicious home pages through Exchange rules that execute code every time the affected folder is opened in Outlook.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Microsoft has released security updates addressing CVE-2017-11774 through the October 2017 MSRC advisory.
- Update all affected Microsoft Outlook installations — Outlook 2010 SP2, Outlook 2013 SP1, and Outlook 2016 are vulnerable. Verify that the security patch has been deployed across all endpoints running these versions.
- Disable the Outlook Home Page feature via Group Policy or registry settings to eliminate the primary attack vector. Set the registry key
HKCU\\Software\\Microsoft\\Office\\{version}\\Outlook\\WebView\\{folder}to prevent custom home page configurations. - Audit Exchange rules and Outlook configurations for signs of malicious home page settings. Check for unauthorized Outlook rules that modify folder home pages, as these can be set remotely through compromised Exchange accounts and persist across sessions.
- Monitor for indicators of compromise including unexpected Outlook Home Page configurations, unusual process spawning from outlook.exe, suspicious Exchange rule modifications, and anomalous command execution originating from the Outlook process. Review email server logs and conduct threat hunting focused on Outlook-based persistence mechanisms.
Technical Details
CVE-2017-11774 exploits the Outlook Home Page feature, where the underlying memory handling vulnerability (CWE-119) in Microsoft Office allows bypassing security restrictions designed to prevent code execution from within Outlook. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) classifies the attack as local with user interaction required, though in practice the Outlook Home Page can be configured remotely through Exchange rules. The Home Page feature allows setting a custom URL to be rendered within an Outlook folder view, and the security feature bypass enables the loaded content to execute arbitrary commands outside the Outlook sandbox. The low attack complexity reflects the straightforward exploitation technique — once a malicious home page URL is configured, code execution occurs automatically when the user navigates to the affected folder. This combination of improper memory buffer operations and security feature bypass makes the vulnerability particularly powerful for establishing persistent access, as the malicious configuration survives Outlook restarts and can be re-applied through Exchange server-side rules.
Frequently Asked Questions
Is CVE-2017-11774 being actively exploited?
Yes. CVE-2017-11774 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The vulnerability has been used by advanced persistent threat groups as a persistent backdoor mechanism through the Outlook Home Page feature. The EPSS score of 82.85% (99.2nd percentile) confirms highly probable exploitation activity.
What products are affected by CVE-2017-11774?
CVE-2017-11774 affects Microsoft Outlook 2010 SP2, Outlook 2013 SP1 (including RT SP1), and Outlook 2016. The vulnerability is in the way Microsoft Office handles objects in memory, specifically impacting the Outlook Home Page feature that allows custom URL rendering within folder views.
How do I fix CVE-2017-11774?
Apply the security updates from Microsoft through the October 2017 MSRC advisory. Additionally, disable the Outlook Home Page feature via Group Policy or registry settings to eliminate the attack vector entirely. Audit Exchange rules for any unauthorized home page configurations that may indicate prior compromise.
How severe is CVE-2017-11774?
CVE-2017-11774 has a CVSS 3.1 score of 7.8 (HIGH). The vulnerability enables arbitrary command execution through Microsoft Outlook and has been weaponized by advanced threat actors. With an EPSS score of 82.85% and confirmed active exploitation, this is a high-priority vulnerability that requires both patching and configuration hardening.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.