Exploit
CVE-2024-38213

Protection Mechanism Failure (CWE-693)

Published: Aug 13, 2024

010
CVSS 6.5EPSS 1.22%Medium
CVE info copied to clipboard

Summary

A Windows Mark of the Web Security Feature Bypass Vulnerability has been identified. This vulnerability is associated with a protection mechanism failure (CWE-693) and affects Microsoft Windows products. The vulnerability has a CVSS v3.1 base score of 6.5, indicating a medium severity level. It requires network access and user interaction, with a low attack complexity. The vulnerability primarily impacts system integrity, with no direct effect on confidentiality or availability.

Impact

If exploited, this vulnerability could allow an attacker to bypass the Windows Mark of the Web (MOTW) security feature. This could potentially lead to the execution of untrusted files without proper security warnings or restrictions. The impact is primarily on system integrity, as indicated by the "HIGH" integrity impact in the CVSS score. Attackers might be able to manipulate or bypass security controls designed to protect users from potentially malicious files downloaded from the internet. This could result in the execution of malware or other malicious content without the user's knowledge or consent, potentially leading to system compromise or data manipulation.

Exploitation

There is no evidence that a public proof-of-concept exists. The vulnerability is actively being exploited in the wild and was added to the CISA Known Exploited Vulnerability list. Its exploitation has been reported by various sources, including cisa.gov. Malware such as Lumma Stealer (source:NetmanageIT CTO Corner), Hydra (source:VERITI), DarkGate (source:Black Hat Ethical Hacking) are known to have weaponized this vulnerability.

Patch

A patch is available for this vulnerability. Microsoft released the patch on August 13, 2024, as part of their regular security updates. The patch can be obtained through the Microsoft Update Guide at the provided URL: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-38213

Mitigation

1. Apply the security update provided by Microsoft as soon as possible. 2. Ensure all Windows systems are set to receive and install updates automatically. 3. Implement the principle of least privilege to minimize the potential impact of any successful exploit. 4. Educate users about the risks of opening files from untrusted sources, even if they appear to be from legitimate senders. 5. Consider implementing additional security measures such as application whitelisting or enhanced email filtering to reduce the risk of malicious file execution. 6. Monitor systems for any suspicious activities, especially those related to file execution from external sources. 7. Keep all security software up-to-date and perform regular security scans.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:F/RL:O/RC:C

Timeline

CVSS

A CVSS base score of 6.5 has been assigned.

Aug 13, 2024 at 5:35 PM / microsoft
First Article

Feedly found the first article mentioning CVE-2024-38213. See article

Aug 13, 2024 at 5:37 PM / #vulnerability
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Aug 13, 2024 at 5:39 PM
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Aug 13, 2024 at 6:10 PM
CVE Assignment

NVD published the first details for CVE-2024-38213

Aug 13, 2024 at 6:15 PM
Exploitation in the Wild

Attacks in the wild have been reported by CISA Known Exploited Vulnerability.

Aug 13, 2024 at 6:30 PM / CISA Known Exploited Vulnerability
Exploitation in the Wild

Attacks in the wild have been reported by CISA - Known exploited vulnerabilities catalog. See article

Threat Intelligence Report

CVE-2024-38213 is a critical security feature bypass vulnerability in Windows Mark of the Web with a CVSSv3 score of 6.5. Microsoft has flagged it as "Exploitation Detected" due to instances of exploitation in the wild. While there are no proof-of-concept exploits currently available, users are advised to be cautious when opening files from untrusted sources and to apply any patches or mitigations provided by Microsoft. See article

Aug 13, 2024 at 7:15 PM
Attribution of Exploits

The vulnerability is known to be exploited by DarkGate. See article

Aug 14, 2024 at 7:09 AM / Black Hat Ethical Hacking
Static CVE Timeline Graph

Affected Systems

Microsoft/windows_server_2012
+null more

Proof Of Exploit

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-38213
+null more

Patches

Microsoft
+null more

Links to Malware Families

DarkGate
+null more

Links to Mitre Att&cks

T1574.010: Services File Permissions Weakness
+null more

Attack Patterns

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
+null more

Vendor Advisory

CVE-2024-38213 - Security Update Guide - Microsoft - Windows Mark of the Web Security Feature Bypass Vulnerability
This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability. It refers to the loss of availability of the impacted component itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of an impacted component.

References

Windows Mark of the Web Security Feature Bypass Vulnerability
What kind of security feature could be bypassed by successfully exploiting this vulnerability? An attacker who successfully exploited this vulnerability could bypass the SmartScreen user experience.
CVE-2024-38213 - Security Update Guide - Microsoft - Windows Mark of the Web Security Feature Bypass Vulnerability
This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability. It refers to the loss of availability of the impacted component itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of an impacted component.
CVE-2024-38213 - Security Update Guide - Microsoft - Windows Mark of the Web Security Feature Bypass Vulnerability
This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability. It refers to the loss of availability of the impacted component itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of an impacted component.
See 22 more references

News

Analysis Report for c3fc2b9c59c1a7a0384f9129c1904fd3f6b829239e619ee5571f6dc1c79e5def
c3fc2b9c59c1a7a0384f9129c1904fd3f6b829239e619ee5571f6dc1c79e5def cve_2024_38213.lnk.txt.lnk likely_malicious application/octet-stream lnk data masquerade 84.38.180.187 EXTERNAL_PARSER 84.38.180.187 INTERNAL 84.38.180.187 INPUT_FILE 00021401-0000-0000-C000-000000000046 INPUT_FILE
DEF CON 32 - Windows Downdate: Downgrade Attacks Using Windows Updates
ā† CVE-2024-38213: From Crumbs to Full Compromise in a Stealthy Cyber Attack ... Schneider Electric Confirms Ransom Hack ā€” Hellcat Demands French Bread ...
CVE-2024-38213: From Crumbs to Full Compromise in a Stealthy Cyber Attack A targeted email campaign exploiting CVE-2024-38213 has been uncovered, disguised as communication related to the Gas Infrastructure Europe Annual Conference in Munich. The attack bypasses standard security protocols to deploy LummaStealer malware, stealing sensitive data. The vulnerability, known as Copy2Pwn, bypasses Windows' Mark-of-the-Web feature, creating a dangerous security gap. Multiple threat actors, including AsyncRAT and XWorm, have been linked to its exploitation. The attack involves a sophisticated multi-stage payload, using system utilities for persistence and obfuscation. Recommendations include restricting certain email attachment types, deploying SIGMA rules for detection, and blocking identified indicators of compromise. Pulse ID: 672dfe5c0ee7260ddc28152d Pulse Link: https:// otx.alienvault.com/pulse/672df e5c0ee7260ddc28152d Pulse Author:
CVE-2024-38213: From Crumbs to Full Compromise in a Stealthy Cyber Attack
The attack bypasses standard security protocols to deploy LummaStealer malware, stealing sensitive data. Multiple threat actors, including AsyncRAT and XWorm, have been linked to its exploitation.
CVE-2024-38213: From Crumbs to Full Compromise in a Stealthy Cyber Attack 
Threat actors are becoming increasingly creative, using vulnerabilities to infiltrate organizations in ways that might not immediately raise alarms. Veritiā€™s research team recently discovered a targeted email campaign utilizing CVE-2024-38213, cleverly disguised to appear associated with the Gas Infrastructure Europe (GIE) Annual Conference in Munich. By taking advantage of this vulnerability, attackers managed to bypass [ā€¦] The post CVE-2024-38213: From Crumbs to Full Compromise in a Stealthy C
See 252 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:Required
Scope:Unchanged
Confidentiality:None
Integrity:High
Availability Impact:None

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI