CVE-2023-24880
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
Description
CVE-2023-24880 is a security feature bypass vulnerability in Windows SmartScreen that allows attackers to craft files that evade Mark of the Web (MOTW) protections. This vulnerability affects a wide range of Microsoft Windows versions including Windows 10, Windows 11, Windows Server 2016, 2019, and 2022. By exploiting this SmartScreen bypass flaw, attackers can distribute malicious files that bypass the warning prompts normally displayed when opening files downloaded from the internet, facilitating malware delivery and execution. CVE-2023-24880 has been confirmed as actively exploited by CISA, is associated with known ransomware campaigns, and carries an EPSS score of 77.29%, indicating a high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1607 | < 10.0.14393.5786 |
| microsoft | windows 10 1809 | < 10.0.17763.4131 |
| microsoft | windows 10 20h2 | < 10.0.19042.2728 |
| microsoft | windows 10 21h2 | < 10.0.19044.2728 |
| microsoft | windows 10 22h2 | < 10.0.19045.2728 |
| microsoft | windows 11 21h2 | < 10.0.22000.1696 |
| microsoft | windows 11 22h2 | < 10.0.22000.1413 |
| microsoft | windows server 2016 | < 10.0.14393.5786 |
| microsoft | windows server 2019 | < 10.0.17763.4131 |
| microsoft | windows server 2022 | < 10.0.20348.1602 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24880(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-24880(US Government Resource)
Weakness Type
CWE-863: Incorrect Authorization
Windows SmartScreen incorrectly authorizes the execution of certain crafted files by failing to properly evaluate the Mark of the Web (MOTW) flag. This incorrect authorization weakness allows attackers to create files that bypass SmartScreen's intended security checks, enabling malicious content to execute without the expected user warning prompts.
Learn more: CWE-863 — Incorrect Authorization
Impact Analysis
CVE-2023-24880 presents a significant risk to Windows environments as a security feature bypass that undermines a key defensive layer against malware delivery. Attack Vector (Local): Exploitation requires the attacker to deliver a malicious file to the victim's system, typically through phishing emails, malicious downloads, or compromised websites. Attack Complexity (Low): The bypass technique is straightforward and does not require special conditions. Privileges Required (None): The attacker does not need any privileges on the target system to craft the malicious file. User Interaction (Required): The victim must open or execute the crafted file, though the bypass removes the SmartScreen warning that would normally alert the user. Confidentiality (None), Integrity (Low), Availability (Low): The direct impact is limited to bypassing a security control, but the downstream consequences include enabling malware execution, ransomware deployment, and data theft. Although the CVSS score of 4.4 (Medium) appears moderate, the confirmed ransomware association and EPSS score at the 98.95th percentile demonstrate that this vulnerability is heavily targeted in real-world attacks as a stepping stone for more severe compromises.
Exploit Maturity
CVE-2023-24880 is actively exploited in the wild, as confirmed by CISA's inclusion in the Known Exploited Vulnerabilities catalog with a remediation deadline of April 4, 2023. Critically, this vulnerability is associated with known ransomware campaigns, where attackers use the SmartScreen bypass to deliver ransomware payloads that evade the Mark of the Web protections. The EPSS score of 77.29% at the 98.95th percentile indicates a high likelihood of continued exploitation. This vulnerability is commonly chained with social engineering techniques — attackers distribute crafted files via phishing emails that bypass SmartScreen warnings, tricking users into executing malicious payloads without the typical security prompts.
Remediation
- Install Microsoft security updates — Apply the March 2023 Patch Tuesday updates for all affected Windows versions as described in the Microsoft Security Response Center advisory. Per CISA's directive, apply mitigations or discontinue use if patches are unavailable.
- Patch all affected Windows versions — Ensure updates are applied across Windows 10 (versions 1607, 1809, 20H2, 21H2, 22H2), Windows 11 (versions 21H2, 22H2), and Windows Server 2016, 2019, and 2022. Prioritize internet-facing workstations and user endpoints.
- Strengthen email and web filtering — Deploy advanced email security gateways and web proxies that inspect attachments and downloads for known SmartScreen bypass techniques. Block file types commonly used in MOTW bypass attacks at the email gateway level.
- Monitor for suspicious file execution — Enable Windows Defender and endpoint detection tools to alert on execution of files without proper MOTW flags. Review endpoint logs for indicators of SmartScreen bypass activity, particularly files with manipulated Authenticode signatures.
- Educate users on phishing risks — Since this vulnerability requires user interaction to open the malicious file, reinforce security awareness training about the risks of opening unexpected file attachments, even when SmartScreen warnings are absent.
Technical Details
CVE-2023-24880 exploits an incorrect authorization weakness (CWE-863) in the Windows SmartScreen security feature's handling of Mark of the Web (MOTW) metadata. Windows SmartScreen normally inspects the Zone.Identifier alternate data stream (ADS) attached to files downloaded from the internet and displays a warning prompt before execution. The vulnerability allows attackers to craft files with specially constructed Authenticode signatures that cause SmartScreen to fail its validation check without triggering the expected warning dialog. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) reflects that the attack requires local file delivery and user interaction to open the file, but the security feature bypass effectively negates a critical defense layer. This is a variant of earlier SmartScreen bypass vulnerabilities, indicating a recurring pattern of authorization logic issues in the MOTW verification process that attackers consistently target for malware distribution.
Frequently Asked Questions
Is CVE-2023-24880 being actively exploited?
Yes, CVE-2023-24880 is actively exploited in the wild. CISA has confirmed active exploitation and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of April 4, 2023. Notably, this vulnerability is associated with known ransomware campaigns that use the SmartScreen bypass to deliver malicious payloads.
What products are affected by CVE-2023-24880?
CVE-2023-24880 affects Microsoft Windows 10 (versions 1607, 1809, 20H2, 21H2, and 22H2), Windows 11 (versions 21H2 and 22H2), Windows Server 2016, Windows Server 2019, and Windows Server 2022. Both client and server editions of affected Windows versions are vulnerable.
How do I fix CVE-2023-24880?
Apply the March 2023 Patch Tuesday security updates from Microsoft for all affected Windows versions. Additionally, strengthen email and web filtering to detect files that attempt to bypass SmartScreen protections, and educate users about the risks of opening unexpected attachments. See the Remediation section for detailed steps.
How severe is CVE-2023-24880?
CVE-2023-24880 is rated Medium severity with a CVSS score of 4.4, but its real-world impact is significantly higher. The vulnerability is confirmed as actively exploited and associated with ransomware campaigns. With an EPSS percentile of 98.95%, it is among the most likely vulnerabilities to be exploited, making prompt patching essential despite the moderate CVSS rating.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.