Saint MonikerLink, of the Exclamation Mark

Patron of links in emails, Protected View, and exclamation marks where they have no business.

Life

On 14 February 2024 Haifei Li of Check Point described CVE-2024-21413, fixed by Microsoft the day before. A link built with an exclamation mark in the right place made Outlook open a remote document without going through Protected View: one click handed the attacker NTLM credentials and, in the worst cases, code execution. CISA added it to the catalogue of exploited vulnerabilities.

Prayer

O Saint MonikerLink, who throws doors open with an exclamation mark, let our links stay just links. Amen.

How to celebrate

Celebrated by installing the February 2024 Office updates and blocking outbound NTLM to the internet, on Valentine's Day.

One exclamation mark, and protection is left speechless.