> Source: [sk180816](https://support.checkpoint.com/results/sk/sk180816)

# sk180816 - Endpoint Mitigation for CVE-2023-23397

| Property | Value |
|----------|-------|
| Solution ID | sk180816 |
| Date Created | 2023-04-03 |
| Last Modified | 2023-04-12 |
| Technical Level | General |
| OS | Windows |

## Solution

Microsoft Outlook Elevation of Privilege Vulnerability [CVE-2023-23397](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23397). is a "zero-touch" elevation of privilege vulnerability in **Microsoft Outlook** .  
During the attack, the victim connects to the attacker's SMB server, and "behind the scenes", automatically sends NTLM negotiation message, which the attacker can use for authentication against other systems that support NTLM authentication.  

The proposed mitigation blocks the outbound TCP 445/SMB to external network, using Endpoint firewall, to prevent Microsoft Outlook authenticating on remote attacker servers.  

Create two new Outbound Fire Wall Rules, in this order:  

1. **SMB-Allow Rule** - allows outbound SMB (port 445) traffic, to the following internal **networks**   

   |-------|---------------------|------------------|-------------|------------|
   | **#** | **Network Address** | **Network Mask** | **Service** | **Action** |
   | **1** | 10.0.0.0            | 255.0.0.0        | SMB         | Allow      |
   | **2** | 172.16.0.0          | 255.240.0.0      | SMB         | Allow      |
   | **3** | 192.168.0           | 255.255.0.0      | SMB         | Allow      |

   <br />

   <br />

2. **SMB-Cleanup Rule** - blocks all other outbound SMB (port 445) traffic  

   |-------|---------------------|------------------|-------------|------------|
   | **#** | **Network Address** | **Network Mask** | **Service** | **Action** |
   | **1** | Any                 | Any              | SMB         | Block      |

<br />

**In Addition** , we recommend blocking **all** **outgoing SMB** traffic when the client is **off-premise** , by creating a different ***Disconnected***policy.

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content