Information disclosure in Microsoft Outlook

Demonstration of a vulnerability affecting Outlook and Exchange services.

By delivering a crafted PDF, an attacker can trigger access through a file download token and exfiltrate or observe sensitive signals using an OAST (Out-of-Band Application Security Testing) callback pattern.

Watch: YouTube