CVE-2024-38165

External Control of File Name or Path (CWE-73)

Published: Aug 13, 2024

010
CVSS 6.5EPSS 0.05%Medium
CVE info copied to clipboard

Summary

A vulnerability in Windows Compressed Folder feature allows for tampering. This is classified as a Windows Compressed Folder Tampering Vulnerability. The vulnerability is associated with CWE-73: External Control of File Name or Path. It affects Windows 11 version 22H2 (up to but not including version 10.0.22621.3880) and Windows 11 version 23H2 (up to but not including version 10.0.22631.3880).

Impact

This vulnerability has a high impact on integrity but no impact on confidentiality or availability. It requires user interaction and can be exploited over a network. The attack complexity is low, and no privileges are required to execute the attack. The overall base CVSS score is 6.5, indicating a medium severity level. Successful exploitation could allow an attacker to manipulate file paths or names, potentially leading to unauthorized file access or execution.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. Microsoft released updates to address this vulnerability on August 13, 2024. Users should apply the latest security updates for Windows 11 version 22H2 (to version 10.0.22621.3880 or later) and Windows 11 version 23H2 (to version 10.0.22631.3880 or later).

Mitigation

To mitigate this vulnerability: 1. Apply the latest security updates from Microsoft for affected Windows 11 versions. 2. Implement the principle of least privilege to limit the potential impact of exploitation. 3. Educate users about the risks of interacting with untrusted compressed folders or files from unknown sources. 4. Consider implementing additional security controls to monitor and restrict file system operations, especially those involving compressed folders. 5. Regularly review and update security policies related to file handling and user permissions.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C

Timeline

CVSS

A CVSS base score of 6.5 has been assigned.

Aug 13, 2024 at 5:35 PM / microsoft
First Article

Feedly found the first article mentioning CVE-2024-38165. See article

Aug 13, 2024 at 5:47 PM / Vulners.com RSS Feed
CVE Assignment

NVD published the first details for CVE-2024-38165

Aug 13, 2024 at 6:15 PM
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Aug 13, 2024 at 6:23 PM
EPSS

EPSS Score was set to: 0.07% (Percentile: 33%)

Nov 19, 2024 at 4:28 PM
Static CVE Timeline Graph

Affected Systems

Microsoft/windows_11_22h2
+null more

Patches

Microsoft
+null more

Links to Mitre Att&cks

T1562.003: Impair Command History Logging
+null more

Attack Patterns

CAPEC-13: Subverting Environment Variable Values
+null more

References

Microsoft August 2024 Security Updates
Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv3.1: 9.8, CVEs: CVE-2024-21302, CVE-2024-29995, CVE-2024-37968, CVE-2024-38063, CVE-2024-38084, CVE-2024-38098, CVE-2024-38106, CVE-2024-38107, CVE-2024-38108, CVE-2024-38109, CVE-2024-38114, CVE-2024-38115, CVE-2024-38116, CVE-2024-38117, CVE-2024-38118, CVE-2024-38120, CVE-2024-38121, CVE-2024-38122, CVE-2024-38123, CVE-2024-38125 (+82 other associated CVEs), Summary: https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2024-patch-tuesday-fixes-9-zero-days-6-exploited/ Today is Microsoft's August 2024 Patch Tuesday, which includes security updates for 89 flaws, including six actively exploited and three publicly disclosed zero-days. Microsoft is still working on an update for a tenth publicly disclosed zero-day. This Patch Tuesday fixed eight critical vulnerabilities, which were a mixture of elevation of privileges, remote code execution, and information disclosure. The number of bugs in each vulnerability category is listed below:
VERT Threat Alert: August 2024 Patch Tuesday Analysis
While updates for CVE-2024-38200 were released as part of the August Patch Tuesday drop, Microsoft had already enabled a fix for this issue on July 30, meaning that all users of supported versions of Office were protected. This vulnerability, a privilege escalation in the Windows Kernel, requires that the attacker win a race condition to successfully exploit it.

News

CNNVD | 关于微软多个安全漏洞的通报
近日,微软官方发布了多个安全漏洞的公告,其中微软产品本身漏洞84个,影响到微软产品的其他厂商漏洞5个。
Microsoft’s August Security Update on High-Risk Vulnerabilities in Multiple Products - Security Boulevard
On August 14, NSFOCUS CERT detected that Microsoft released a security update patch for August, which fixed 90 security issues involving widely used products such as Windows, Microsoft Office, Visual Studio and Azure, including high-risk vulnerabilities such as privilege escalation and remote code execution. Due to an error in the Windows Power Dependency Coordinator after release, local attackers authenticated by ordinary users can exploit this vulnerability by running special programs to obtain SYSTEM permissions of the target system.
CNNVD关于微软多个安全漏洞的通报
近日,微软官方发布了多个安全漏洞的公告,其中微软产品本身漏洞84个,影响到微软产品的其他厂商漏洞5个。
August Patch Tuesday goes big – Sophos News
(It should be noted that one issue patched in June, CVE-2024-38213, is under active attack in the wild – a good argument for applying patches as soon as possible after release.) Microsoft also took pains this month to flag three other CVEs for which fixes have already gone out, but that are included in Patch Tuesday information for transparency’s sake; we list those in Appendix D as well. However, with over two dozen advisories, a number of “informational” notices concerning material released in June and July, two high-profile issues for which the fixes are still a work in progress, and over 85 Linux-related CVEs covered in the release, administrators may find their patch prioritization especially complex this month.
August Patch Tuesday goes big
(It should be noted that one issue patched in June, CVE-2024-38213, is under active attack in the wild – a good argument for applying patches as soon as possible after release.) Microsoft also took pains this month to flag three other CVEs for which fixes have already gone out, but that are included in Patch Tuesday information for transparency’s sake; we list those in Appendix D as well. However, with over two dozen advisories, a number of “informational” notices concerning material released in June and July, two high-profile issues for which the fixes are still a work in progress, and over 85 Linux-related CVEs covered in the release, administrators may find their patch prioritization especially complex this month.
See 23 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:Required
Scope:Unchanged
Confidentiality:None
Integrity:High
Availability Impact:None

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI