CVE-2024-21412
Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability
Description
CVE-2024-21412 is an Internet Shortcut Files Security Feature Bypass vulnerability affecting multiple versions of Microsoft Windows, including Windows 10, Windows 11, and Windows Server 2019/2022. The vulnerability stems from a Protection Mechanism Failure (CWE-693), allowing attackers to craft malicious internet shortcut files that bypass Windows security warnings and protections. A remote attacker can exploit CVE-2024-21412 by convincing a user to open a specially crafted .url file, potentially achieving high-impact compromise of the target system's confidentiality and integrity. This vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog, confirmed as exploited in ransomware campaigns, and carries an EPSS score of 93.8% — placing it in the top 0.2% of all vulnerabilities for exploitation likelihood.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1809 | < 10.0.17763.5458 |
| microsoft | windows 10 21h2 | < 10.0.19044.4046 |
| microsoft | windows 10 22h2 | < 10.0.19045.4046 |
| microsoft | windows 11 21h2 | < 10.0.22000.2777 |
| microsoft | windows 11 22h2 | < 10.0.22621.3155 |
| microsoft | windows 11 23h2 | < 10.0.22631.3155 |
| microsoft | windows server 2019 | < 10.0.17763.5458 |
| microsoft | windows server 2022 | < 10.0.20348.2322 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.709 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21412(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21412(US Government Resource)
Weakness Type
CWE-693: Protection Mechanism Failure
CWE-693 describes a weakness where a product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks. In the context of CVE-2024-21412, Windows fails to properly enforce its Mark of the Web (MotW) security feature, which is designed to warn users when opening files downloaded from the internet — allowing crafted internet shortcut files to bypass this critical defense.
Learn more: CWE-693 — Protection Mechanism Failure
Impact Analysis
CVE-2024-21412 carries a CVSS score of 8.1 (HIGH) and is remotely exploitable over the network, requiring no authentication to target a system — only a single user interaction (opening a crafted shortcut file) is needed. Confidentiality (High): Successful exploitation can expose sensitive data accessible to the targeted user account, since an attacker can bypass protective mechanisms designed to flag untrusted content. Integrity (High): Attackers can deliver and execute malicious payloads, potentially modifying system files, installing malware, or establishing persistence — all under the guise of a legitimate file. Availability (None): No direct availability impact is indicated by the CVSS metrics, though secondary payloads dropped during exploitation may affect system availability. With an EPSS score of 93.8% (99th percentile) and confirmed ransomware usage, this vulnerability represents a critical, high-urgency risk for any organization running affected Windows versions.
Exploit Maturity
CVE-2024-21412 is actively exploited in the wild and has been confirmed by CISA in the Known Exploited Vulnerabilities catalog with a remediation deadline of March 5, 2024. Microsoft Windows is the KEV-listed affected product, and ransomware operators have been documented using this vulnerability — making it a high-priority threat requiring immediate action. The EPSS score of 93.8%, placing this vulnerability in the 99.8th percentile, indicates near-certain exploitation activity across the threat landscape. No specific exploit reference URLs were tagged as "Exploit" in the provided references, but the combination of KEV status, ransomware association, and extremely high EPSS percentile confirms that weaponized exploit code is in active use by threat actors.
Remediation
- Apply the Microsoft security update referenced in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21412 — this is the primary remediation per CISA's required action.
- Prioritize patching all affected Windows versions: Windows 10 1809/21H2/22H2, Windows 11 21H2/22H2/23H2, Windows Server 2019, Windows Server 2022, and Windows Server 2022 23H2.
- As an interim mitigation, restrict execution of .url and internet shortcut files via application control policies (e.g., AppLocker or Windows Defender Application Control) to block delivery of malicious shortcut files.
- Enable and monitor Windows Defender SmartScreen and Mark of the Web enforcement through Group Policy; review logs for bypasses or unusual internet shortcut file execution.
- Educate users not to open .url files or internet shortcut files received via email or untrusted channels, and implement email attachment filtering to block shortcut file types at the mail gateway.
Technical Details
CVE-2024-21412 exploits a failure in Windows' Protection Mechanism (CWE-693), specifically targeting how the operating system processes Internet Shortcut (.url) files and applies Mark of the Web (MotW) security tags. Normally, files downloaded from the internet receive a MotW attribute that triggers security warnings and sandbox restrictions when opened; however, a specially crafted .url file can bypass this enforcement, allowing the content to execute without the expected security prompts. The attack vector is network-based, requiring low attack complexity and no privileges — only user interaction in the form of opening the crafted file is needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). This makes phishing and drive-by download scenarios the most likely delivery mechanisms. The scope remains unchanged, meaning the primary risk is to the component and user context directly interacting with the malicious shortcut file.
Frequently Asked Questions
Is CVE-2024-21412 being actively exploited?
Yes. CVE-2024-21412 is confirmed as actively exploited in the wild by CISA and appears in the Known Exploited Vulnerabilities (KEV) catalog. Ransomware operators have been documented leveraging this vulnerability, and its EPSS score of 93.8% (99.8th percentile) confirms widespread exploitation activity.
What products are affected by CVE-2024-21412?
CVE-2024-21412 affects multiple versions of Microsoft Windows, including Windows 10 (1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), Windows Server 2019, Windows Server 2022, and Windows Server 2022 23H2. Organizations running any of these versions without the relevant security patch are at risk.
How do I fix CVE-2024-21412?
Apply the official Microsoft security patch available via the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21412. As interim mitigations, restrict execution of internet shortcut files using application control policies and ensure SmartScreen is enforced via Group Policy. See the Remediation section for full step-by-step guidance.
How severe is CVE-2024-21412?
CVE-2024-21412 is rated HIGH severity with a CVSS score of 8.1. Its EPSS percentile of 99.8% places it among the most actively exploited vulnerabilities tracked, and its confirmed use in ransomware campaigns makes it a critical priority for immediate patching across all affected Windows environments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.