CVE-2024-20652
External Control of File Name or Path (CWE-73)
Summary
A security feature bypass vulnerability exists in the Windows HTML Platform that allows an attacker to bypass security features, potentially leading to malicious code execution. This vulnerability affects all supported versions of Windows 10, Windows 11, and Windows Server from 2012 through 2022. The vulnerability specifically enables attackers to circumvent the MapURLToZone method by exploiting Lanman redirector or WebDav device paths to force an 'Intranet' Zone value.
Impact
An attacker who successfully exploits this vulnerability could execute arbitrary code on the target system with elevated privileges. This could lead to complete compromise of the affected system, enabling data theft, deployment of malware, and other severe impacts. The vulnerability has a CVSS v3.1 base score of 8.1, indicating high severity. It affects the confidentiality, integrity, and availability of the system, all rated as "HIGH" impact.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
Microsoft has released security updates to address this vulnerability. Patches are available through the regular Windows Update process for all affected versions. The specific patch versions vary by Windows version: - Windows 11 23H2: patched in version 10.0.22631.3007 - Windows 11 22H2: patched in version 10.0.22621.3007 - Windows 11 21H2: patched in version 10.0.22000.2713 - Windows 10 22H2, 21H2: patched in version 10.0.19045.3930 - Windows 10 1809: patched in version 10.0.17763.5329 - Windows 10 1607: patched in version 10.0.14393.6614 - Windows 10 1507: patched in version 10.0.10240.20402 - Windows Server 2022, 2019, 2016, 2012 R2, and 2012: patches available (specific version numbers not provided) It's crucial to update to these versions or later to mitigate the vulnerability.
Mitigation
1. Apply the latest security updates from Microsoft as soon as possible. 2. Prioritize patching on Internet-exposed systems first, then move to internal systems based on risk assessment and asset value. 3. Until patched, restrict untrusted HTML content and web browsing on affected systems. 4. Implement network segmentation and least privilege principles to limit potential impact. 5. Monitor systems for unusual activities that could indicate exploitation attempts. 6. Keep all Windows systems and applications up-to-date with the latest security patches as a general best practice.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
NVD published the first details for CVE-2024-20652
Feedly found the first article mentioning CVE-2024-20652. See article
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.2% (Percentile: 57.6%)
The vulnerability CVE-2024-20652 is a critical security feature bypass vulnerability in Windows HTML Platforms. It is currently being exploited in the wild by unknown actors. There are no proof-of-concept exploits available, and no mitigations, detections, or patches have been released yet. The impact on third-party vendors or technology downstream is unknown at this time. See article
A CVSS base score of 8.1 has been assigned.
A CVSS base score of 8.1 has been assigned.