Loading vulnerability…
Microsoft Windows SmartScreen Internet Shortcut Security Feature Bypass
CVE-2023-36025 is a security feature bypass vulnerability in Microsoft Windows Defender SmartScreen caused by insufficient security checks and associated warning prompts when processing specially crafted Internet Shortcut (.url) files. A user who opens a malicious shortcut, or follows a hyperlink to one, can cause attacker-controlled payloads to be accessed and executed without the expected SmartScreen warnings. Observed exploitation includes shortcuts referencing malicious payloads within ZIP archives on remote SMB or WebDAV shares. The vulnerability has been exploited to deliver malware including Phemedrone Stealer and DarkGate. Microsoft released a fix on November 14, 2023.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation suppresses an expected security boundary against untrusted downloads and execution, facilitating malware installation under the affected user's security context. Observed downstream consequences include credential and session-token theft, cryptocurrency wallet and file theft, remote command execution, and persistent remote access. These consequences depend on the delivered payload; the vulnerability itself is a SmartScreen bypass rather than an independent privilege-escalation or memory-corruption code-execution primitive.
If you can’t patch tonight, do this now.
No vendor-supported alternative workaround is specified. As defense in depth, prevent users from opening Internet Shortcut files from untrusted sources, filter suspicious shortcut attachments and archive contents, and restrict unnecessary outbound SMB and WebDAV access to untrusted servers. These measures reduce exposure to observed delivery mechanisms but do not replace patching.
Patch, then assume compromise.
Install the applicable Microsoft Windows security updates released on November 14, 2023, or subsequent cumulative updates containing the CVE-2023-36025 fix. Maintain current Windows security updates because related SmartScreen bypass vulnerabilities, including CVE-2024-21412, subsequently enabled attackers to circumvent protections introduced for the earlier flaw.
2 exploits validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.