Loading vulnerability…
Windows NTLM Hash Disclosure Spoofing Vulnerability
CVE-2024-43451 is an actively exploited Microsoft Windows vulnerability that exposes a user's NTLMv2 authentication material through minimal interaction with a specially crafted Internet shortcut file. A shortcut referencing an attacker-controlled SMB resource can trigger outbound authentication when selected, right-clicked, deleted, or dragged, depending on the Windows version and configuration; opening or executing the file is not required. Microsoft released security updates on November 12, 2024. Windows Server 2012, including Server Core installations, is not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can capture the logged-in user's NTLMv2 authentication material and potentially impersonate that user. Captured NTLMv2 challenge-response material may support offline password cracking or authentication relay under suitable conditions; it is not itself an NT password hash directly usable for pass-the-hash. Exploitation has appeared in attack chains delivering malware, including SparkRAT, but payload execution and full system takeover are follow-on outcomes rather than an established direct code-execution capability of this vulnerability.
If you can’t patch tonight, do this now.
Until patching is complete, avoid interacting with untrusted Internet shortcut files, including selecting, inspecting, deleting, or dragging them. Defense-in-depth measures include blocking outbound SMB to untrusted networks, restricting NTLM authentication destinations, and monitoring unexpected outbound authentication associated with file interactions. These controls reduce credential-disclosure exposure but do not replace the security update.
Patch, then assume compromise.
Install the Microsoft security updates addressing CVE-2024-43451, initially released on November 12, 2024, or applicable superseding updates. Systems receiving Security Only updates on Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012 R2 also require the applicable Internet Explorer cumulative updates for full protection. Specific KB numbers and fixed builds are not available in the supplied information.
1 exploit validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
38 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.