Medium

Microsoft Windows its:// Protocol Handler Information Disclosure

IdentifiersCVE-2017-11927CWE-200· Exposure of Sensitive Information…

CVE-2017-11927 is a Microsoft Windows information disclosure vulnerability affecting multiple supported Windows versions. According to the provided description, the flaw exists in the way the Windows its:// protocol handler determines the security zone of a request. Incorrect zone determination can cause content to be treated with less restrictive trust assumptions than intended, enabling disclosure of information. Supporting context indicates Microsoft associated this CVE with fixes for payloads abused through Outlook-rendered HTML content that could trigger outbound requests via URI schemes including its and related handlers, though the core vulnerability description provided here is the Windows its:// protocol handler’s improper zone handling.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can disclose information to an attacker. Based on the supporting context, this included the ability to induce outbound authentication-related requests and potentially expose SMB credential material or otherwise confirm message viewing/tracking in scenarios where the vulnerable handler was reachable through crafted content. The primary documented impact for this CVE is information disclosure rather than direct code execution or privilege escalation.

Mitigation

If you can’t patch tonight, do this now.

Where patching cannot be applied immediately, reduce exposure to attacker-controlled content that can invoke the vulnerable handler. The supporting context recommends operational mitigations relevant to the associated Outlook abuse path, including reading email in plain text, disabling or limiting preview of untrusted email, deleting suspicious messages without opening them, blocking outbound SMB ports 445 and 139, using host firewall controls, and applying Restrict NTLM policies where appropriate. Note that blocking SMB does not necessarily prevent DNS or WebDAV-based tracking behaviors described in the supporting material.

Remediation

Patch, then assume compromise.

Apply the Microsoft security updates associated with CVE-2017-11927. The provided context states the initial fix was released in December 2017 and was updated in May 2018 to address remaining issues referenced in the related research. Systems should be brought fully up to date with the latest cumulative/security updates for the affected Windows versions.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationWindows 10operating_system

Microsoft CorporationWindows 7operating_system

Microsoft CorporationWindows 8.1operating_system

Microsoft CorporationWindows Rt 8.1operating_system

Microsoft CorporationWindows Serverapplication

Microsoft CorporationWindows Server 2008operating_system

Microsoft CorporationWindows Server 2012operating_system

Microsoft CorporationWindows Server 2016operating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

soroushNews

Aug 13, 2018

SMB hash hijacking & user tracking in MS Outlook

A Microsoft Outlook-related vulnerability/patch identifier referenced by MSRC as addressing additional payloads associated with the SMB hash hijacking and user-tracking issue. The patch was later updated in May 2018 to address remaining issues.

ncc group researchNews

May 11, 2018

SMB hash hijacking & user tracking in MS Outlook

A Microsoft Outlook-related patch/advisory referenced as addressing additional payloads for the crafted-email SMB/WebDAV request issue, with an updated patch in May 2018 to cover remaining cases.

soroush secprojectNews

May 26, 2026

A Microsoft Outlook-related patch/CVE addressing additional payloads for the SMB hash hijacking and user-tracking issue triggered by crafted email content.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity