CVE-2022-41091
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
Description
CVE-2022-41091 is a security feature bypass vulnerability in the Windows Mark of the Web (MotW) mechanism. This flaw allows attackers to craft files that evade the MotW protections, which normally warn users and restrict execution of files downloaded from the internet. By exploiting this improper authorization weakness, an attacker can deliver malicious files that bypass Windows security prompts, potentially leading to unauthorized code execution on the target system. CVE-2022-41091 is listed in CISA's Known Exploited Vulnerabilities catalog and has been associated with ransomware campaigns, making it a significant threat across all supported versions of Microsoft Windows.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19567 |
| microsoft | windows 10 1607 | < 10.0.14393.5501 |
| microsoft | windows 10 1809 | < 10.0.17763.3650 |
| microsoft | windows 10 20h2 | < 10.0.19042.2251 |
| microsoft | windows 10 21h1 | < 10.0.19043.2251 |
| microsoft | windows 10 21h2 | < 10.0.19044.2251 |
| microsoft | windows 10 22h2 | < 10.0.19045.2251 |
| microsoft | windows 11 21h2 | < 10.0.22000.1219 |
| microsoft | windows 11 22h2 | < 10.0.22621.819 |
| microsoft | windows server 2016 | < 10.0.14393.5501 |
| microsoft | windows server 2019 | < 10.0.17763.3650 |
| microsoft | windows server 2022 | < 10.0.20348.1249 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41091(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41091(US Government Resource)
Weakness Type
CWE-863: Incorrect Authorization
In the context of CVE-2022-41091, the incorrect authorization weakness manifests in how Windows handles Mark of the Web metadata for certain file types. The MotW security feature fails to properly enforce authorization checks on downloaded files, allowing crafted content to bypass the protective warnings that would normally prevent execution of untrusted files.
Learn more: CWE-863 — Incorrect Authorization
Impact Analysis
CVE-2022-41091 carries a CVSS v3.1 score of 5.4 (Medium severity), reflecting a security feature bypass with limited but meaningful impact. Attack Vector (Network): The vulnerability is remotely exploitable, as attackers can deliver malicious files via email, web downloads, or other network-based delivery mechanisms without requiring physical access to the target. Attack Complexity (Low): Exploitation is straightforward and does not require special conditions or advanced techniques. Privileges Required (None): No authentication or elevated privileges are needed on the target system. User Interaction (Required): A victim must open or interact with the malicious file for exploitation to succeed. Integrity Impact (Low): The bypass undermines the trust model of downloaded files, allowing unauthorized modifications to system behavior. Availability Impact (Low): Some disruption is possible depending on the payload delivered through the bypassed security mechanism. With an EPSS score of 6.95% placing it in the 91st percentile, this vulnerability has a notable probability of exploitation. Critically, CVE-2022-41091 has been used in ransomware campaigns, underscoring the real-world danger of this MotW bypass when combined with additional attack payloads.
Exploit Maturity
Active exploitation of CVE-2022-41091 has been confirmed by CISA, which added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of December 9, 2022. This Windows Mark of the Web bypass has been leveraged in ransomware operations, making it particularly dangerous as threat actors use it to deliver payloads that would otherwise be blocked by Windows security prompts. The EPSS score of 6.95% (91st percentile) indicates a significantly elevated probability of exploitation compared to most vulnerabilities. Organizations that have not yet patched should treat this as an urgent priority given the confirmed ransomware association and active exploitation in the wild.
Remediation
- Apply Microsoft security updates immediately as directed by the vendor advisory at the Microsoft Security Response Center. CISA requires federal agencies to apply mitigations by December 9, 2022, or discontinue use of the affected product if patches are unavailable.
- Patch all affected Windows versions, including Windows 10 (versions 1507, 1607, 1809, 20H2, 21H1, 21H2, 22H2), Windows 11 (21H2, 22H2), and Windows Server 2016, 2019, and 2022. Prioritize systems that handle externally sourced files.
- Implement additional email and web gateway filtering to inspect and block suspicious file types commonly used to exploit MotW bypasses, such as ISO images, ZIP archives with specific structures, and files with manipulated Zone.Identifier streams.
- Monitor endpoints for indicators of compromise by reviewing security logs for unusual file execution patterns, particularly files that were downloaded from the internet but executed without triggering SmartScreen or Protected View warnings.
- Enforce application control policies using Windows Defender Application Control (WDAC) or AppLocker to restrict execution of untrusted binaries, providing defense-in-depth against MotW bypass attacks.
Technical Details
CVE-2022-41091 exploits a flaw in the Windows Mark of the Web security feature, which is responsible for tagging files downloaded from the internet with a Zone.Identifier alternate data stream (ADS). This ADS marker triggers security mechanisms such as SmartScreen checks and Protected View in Microsoft Office applications. The vulnerability stems from an incorrect authorization issue (CWE-863) where certain file types or delivery methods can circumvent the MotW tagging process. Attack Vector (Network) with Attack Complexity (Low) means that an attacker can craft a malicious file and deliver it via standard network channels such as phishing emails or compromised websites. Although User Interaction is Required, the absence of any Privileges Required means any user who opens the crafted file can be affected. The bypass allows downloaded files to be treated as locally created content, effectively removing the security warnings and restrictions that MotW is designed to enforce, enabling subsequent payloads to execute without additional user consent.
Frequently Asked Questions
Is CVE-2022-41091 being actively exploited?
Yes, CVE-2022-41091 is being actively exploited in the wild. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, and it has been specifically associated with ransomware campaigns. Organizations should prioritize patching this vulnerability immediately.
What products are affected by CVE-2022-41091?
CVE-2022-41091 affects a wide range of Microsoft Windows operating systems, including Windows 10 (versions 1507, 1607, 1809, 20H2, 21H1, 21H2, and 22H2), Windows 11 (versions 21H2 and 22H2), and Windows Server 2016, 2019, and 2022. All supported editions of these versions are impacted.
How do I fix CVE-2022-41091?
Apply the latest security updates from Microsoft available through the Microsoft Security Response Center. Ensure all affected Windows systems are patched, and implement additional protections such as email gateway filtering and application control policies to mitigate the risk of MotW bypass attacks.
How severe is CVE-2022-41091?
CVE-2022-41091 has a CVSS v3.1 score of 5.4 (Medium severity). However, its real-world impact is elevated due to confirmed active exploitation and use in ransomware campaigns. The EPSS score of 6.95% places it in the 91st percentile, indicating significantly higher exploitation likelihood than most vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.