Microsoft Outlook Custom Forms Remote Code Execution

CVE-2024-21378 is an authenticated remote code execution vulnerability in Microsoft Outlook involving unsafe handling of synced custom form objects. According to the provided content, Outlook installs forms synchronized through MAPI using IPM.Microsoft.FolderDesign.FormsDescription objects and uses form properties such as PidTagOfflineAddressBookName and PidTagOfflineAddressBookDistinguishedName during installation. NetSPI found that a malicious form could abuse attachment handling, including path traversal via the PidTagAttachFilename property, to write arbitrary files under the local Outlook FORMS directory, and could also create arbitrary registry keys with default values under HKEY_CLASSES_ROOT during form installation. The content further states that Outlook contained a denylist in OLMAPI32.DLL intended to block dangerous COM registration paths, but this could be bypassed by supplying a leading backslash-style full subkey path such as CLSID{GUID}\InprocServer32. By combining arbitrary file write and arbitrary HKCR registry key creation, an attacker could register a COM object backed by an attacker-controlled DLL and cause Outlook to load it when the malicious form was triggered in the Windows thick client.