Pierluigi Paganini September 30, 2019

Microsoft announced last week it is going to expand the list of file extensions that are blocked in Outlook on the web.

Microsoft announced that it will immediately block other file extensions for its Outlook web users, it will impossible for them to download this type of attachments.

Microsoft pointed out that the newly blocked file types are rarely used, this means that most organizations will face no problems with the change.

The list of file types that will be blocked by Microsoft include ones used by popular programing languages such as “.py“, “.pyc“, “.pyo“, “.pyw“, “.pyz“, “.pyzw” (used by Python); “.ps1″, “.ps1xml”, “.ps2″, “.ps2xml”, “.psc1″, “.psc2″, “.psd1″, “.psdm1″, “.psd1″, “.psdm1″, “.cdxml” and “.pssc” (used by PowerShell); and “.jar” and “.jnlp” (used by Java).

Microsoft announced it will block also “.appcontent-ms“, “.settingcontent-ms“, “.cnt“, “.hpj“, “.website”, “.webpnp“, “.mcf“, “.printerexport“, “.pl“, “.theme”, “.vbp“, “.xbap“, “.xll“, “.xnk“, “.msu“, “.diagcab” and “.grp“.

Other file types that will be blocked by the tech giant are the ones having the “.appref-ms” extension used by Windows ClickOnce, the “.udl” extension used by Microsoft Data Access Components (MDAC), the “.wsb” extension used by Windows sandbox, and the “.cer“, “.crt” and “.der” extensions associated with digital certificates.

“The following extensions are used by various applications.” reads the post published by Microsoft.”While the associated vulnerabilities have been patched (for years, in most cases), they are being blocked for the benefit of organizations that might still have older versions of the application software in use:

“.appcontent-ms”, “.settingcontent-ms”, “.cnt”, “.hpj”, “.website”, “.webpnp”, “.mcf”, “.printerexport”, “.pl”, “.theme”, “.vbp”, “.xbap”, “.xll”, “.xnk”, “.msu”, “.diagcab”, “.grp”“

In case organizations have to allow for the use of a particular file type, admins could add specific extensions to the AllowedFileTypes property of users’ OwaMailboxPolicy objects.

“If you want a particular file type to be allowed, you can add that file type to the AllowedFileTypes property of your users’ OwaMailboxPolicy objects.” continues the post. “To add a file extension to the AllowedFileTypes list:

$policy = Get-OwaMailboxPolicy [policy name]
$allowedFileTypes = $policy.AllowedFileTypes
$allowedFileTypes.Add(".foo")
Set-OwaMailboxPolicy $policy -AllowedFileTypes $allowedFileTypes

“Security of our customer’s data is our utmost priority, and we hope our customers will understand and appreciate this change. Change can be disruptive, so we hope the information here explains what we’re doing and why,” Microsoft concludes.

Pierluigi Paganini

(SecurityAffairs – Outlook, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]