Security News > 2024 > July > Zero-day patched by Microsoft has been exploited by attackers for over a year (CVE-2024-38112)

CVE-2024-38112, a spoofing vulnerability in Windows MSHTML Platform for which Microsoft has released a fix on Tuesday, has likely been exploited by attackers in the wild for over a year, Check Point researcher Haifei Li has revealed.

"Check Point Research recently discovered that threat actors have been using novel tricks to lure Windows users for remote code execution. Specifically, the attackers used special Windows Internet Shortcut files, which, when clicked, would call the retired Internet Explorer to visit the attacker-controlled URL," he explained.

Url - would look as a benign file to most Windows users because it would point to a customized icon in the Microsoft Edge application file - in this case, an icon for PDF files.

This trick allows the attackers to continue hiding the file's true nature from the user who is intent on opening it by clicking through several pop-up warnings; the PDF file is actually a malicious HTA file, which executes and enables RCE. IE pop-up shows only the PDF extension.

Microsoft has been notified in May, and has now finally issued a patch, preventing URL files from triggering the MHTML: URI handler.

Morphisec researchers have warned that the patch for CVE-2024-38021 - a Microsoft Office vulnerability that can be exploited remotely and could lead to RCE - should also be implemented sooner rather than later.

News URL

https://www.helpnetsecurity.com/2024/07/10/cve-2024-38112-cve-2024-38021/