Protection mechanism failure in Microsoft Windows and Windows Server - CVE-2024-29988

Vulnerability details

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient implementation of the Mark of the Web (MotW) feature. A remote attacker can supply a malicious file inside an archive to bypass EDR/NDR detection, bypass the SmartScreen prompt and compromise the affected system.

Note, the vulnerability is being actively exploited in the wild.

Affected software

How to mitigate CVE-2024-29988

Links to Public Exploits and PoC-codes

• Exploit #9896 - CVE-2024-29988-exploit (May 31, 2024)

External References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29988
• https://www.zerodayinitiative.com/blog/2024/4/9/the-april-2024-security-updates-review
• https://www.zerodayinitiative.com/advisories/ZDI-24-361/

Related Security Bulletins

• SmartScreen prompt bypass in Microsoft Windows