CVE-2024-29988
Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability
Description
CVE-2024-29988 is a high-severity security feature bypass vulnerability in Microsoft SmartScreen Prompt that allows attackers to circumvent the Mark of the Web (MotW) security warnings normally displayed when users open files downloaded from the internet. With a CVSS v3.1 base score of 8.8, successful exploitation enables malicious files to execute without the security warnings that would normally alert users to potential dangers. CISA has added CVE-2024-29988 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of May 21, 2024, and its EPSS score of 66.84% at the 98.5th percentile reflects extensive active exploitation across the threat landscape.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1809 | < 10.0.17763.5696 |
| microsoft | windows 10 21h2 | < 10.0.19044.4291 |
| microsoft | windows 10 22h2 | < 10.0.19045.4291 |
| microsoft | windows 11 21h2 | < 10.0.22000.2899 |
| microsoft | windows 11 22h2 | < 10.0.22621.3447 |
| microsoft | windows 11 23h2 | < 10.0.22631.3447 |
| microsoft | windows server 2019 | < 10.0.17763.5696 |
| microsoft | windows server 2022 | < 10.0.20348.2402 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.830 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29988(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-29988(US Government Resource)
Weakness Type
SmartScreen Security Feature Bypass
CVE-2024-29988 bypasses the Microsoft SmartScreen Prompt security feature, which is a critical defense mechanism in Windows that warns users when they attempt to open files that have been downloaded from the internet or received via email. SmartScreen relies on the Mark of the Web (MotW) zone identifier, an NTFS alternate data stream that tags files with their origin. When a file carries the MotW tag, SmartScreen displays a security prompt requiring user confirmation before execution. This vulnerability allows attackers to craft files that evade the MotW tagging mechanism or bypass SmartScreen's evaluation logic, enabling malicious executables, scripts, or documents to run without generating the expected security warning. This weakness is related to CWE-693 (Protection Mechanism Failure), where a designed security mechanism is circumvented rather than directly exploited. Learn more about CWE-693
Impact Analysis
The impact of CVE-2024-29988 is severe across all dimensions of the CIA triad. Confidentiality is rated high because the SmartScreen bypass enables malicious payloads to execute without user warning, allowing attackers to deploy information stealers, remote access trojans, and credential harvesting tools that can access all data available to the current user. SmartScreen is one of the primary defenses preventing users from inadvertently running malicious downloads, and its bypass removes a critical friction point in the attack chain.
Integrity faces high impact because the bypass enables silent execution of malicious code that can modify files, install persistent malware, alter system configurations, and compromise the software supply chain on affected systems. Without SmartScreen warnings, users have no visual indication that the file they are opening originated from an untrusted source.
Availability is rated high because the unrestricted execution of malicious payloads can lead to ransomware deployment, system corruption, data destruction, or denial of service conditions. The attack is network-based (AV:N) with low complexity (AC:L), requires no privileges (PR:N), and needs only user interaction (UI:R) in the form of opening the malicious file. The EPSS score of 66.84% at the 98.5th percentile places this vulnerability among the top 2% most likely to be exploited. CISA classifies the ransomware association as "Unknown," but SmartScreen bypasses are frequently used by ransomware operators to deliver their payloads without triggering user warnings.
Exploit Maturity
CVE-2024-29988 has reached very high exploit maturity, with CISA confirming active exploitation by adding it to the Known Exploited Vulnerabilities catalog. Microsoft addressed the vulnerability in the April 2024 Patch Tuesday update.
The EPSS score of 66.84% at the 98.5th percentile indicates that this vulnerability is among the most heavily exploited in the current landscape. SmartScreen bypass vulnerabilities are extremely valuable to threat actors because they remove one of the most visible security barriers in the Windows attack chain. When SmartScreen prompts are bypassed, users receive no warning that a downloaded file may be dangerous, dramatically increasing the success rate of phishing campaigns and drive-by download attacks. Multiple threat actor groups have incorporated SmartScreen bypasses into their delivery chains, including operators of information stealers, banking trojans, and ransomware. The ransomware association is classified as "Unknown" by CISA, but the practical utility of this bypass for ransomware delivery is well established, as ransomware operators frequently rely on users executing downloaded payloads to initiate their attack chains.
Remediation
-
Apply the April 2024 Microsoft security updates immediately to all affected Windows systems. The patch is available through Microsoft's advisory and Windows Update. Affected systems include Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), and Windows Server 2019, 2022, and 2022 23H2.
-
Enforce SmartScreen policies via Group Policy to ensure that SmartScreen cannot be disabled by users and that the most restrictive settings are applied. Configure "Windows Defender SmartScreen" settings to "Block" untrusted applications rather than just warning users.
-
Implement email and web gateway filtering to block the delivery mechanisms commonly used with SmartScreen bypasses. Filter for suspicious file types including .url, .lnk, .iso, .img, and archives containing executable content. Configure email security to strip or quarantine files that may bypass MotW protections.
-
Deploy application control policies using Windows Defender Application Control (WDAC) or AppLocker to prevent execution of unauthorized applications regardless of SmartScreen status. These controls enforce execution restrictions at a deeper level than SmartScreen and are not affected by MotW bypass techniques.
-
Educate users about social engineering tactics that leverage SmartScreen bypasses. Train users to be suspicious of unexpected file downloads, email attachments, and links from unknown sources, even when no SmartScreen warning appears, and to verify file authenticity through alternative channels before execution.
Technical Details
CVE-2024-29988 is a security feature bypass vulnerability in the Microsoft SmartScreen Prompt. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, resulting in a base score of 8.8 (High).
SmartScreen is a Windows security feature that evaluates files downloaded from the internet using the Mark of the Web (MotW) zone identifier. When a file is downloaded through a web browser or email client, Windows marks it with an NTFS alternate data stream (Zone.Identifier) that contains metadata about the file's origin, including the security zone (typically zone 3 for internet downloads). When a user attempts to execute a MotW-tagged file, SmartScreen displays a security prompt warning that the file came from an untrusted source and requesting explicit user confirmation.
CVE-2024-29988 bypasses this protection mechanism by exploiting a flaw in how SmartScreen processes certain file types or delivery mechanisms. The bypass allows an attacker to deliver a malicious file that either does not receive the MotW tag when downloaded, or that circumvents SmartScreen's evaluation logic even when the tag is present. This can involve container formats that strip the MotW from enclosed files, specially crafted shortcut files (.lnk or .url) that reference payloads without triggering SmartScreen evaluation, or manipulation of the zone identifier metadata.
The Attack Vector (AV:N) confirms that the malicious file is delivered remotely. Attack Complexity (AC:L) is low because creating a SmartScreen-bypassing payload does not require complex techniques. Privileges Required (PR:N) is none, as the attacker needs no account on the target system. User Interaction (UI:R) is required because the user must open or execute the delivered file. The Scope (S:U) is unchanged, and all CIA metrics are rated high (C:H/I:H/A:H) because the unrestricted execution of the malicious payload enables full system compromise. Affected versions include Windows 10 builds through 19045, Windows 11 builds through 22631, and Windows Server 2019, 2022, and 2022 23H2.
Frequently Asked Questions
What is CVE-2024-29988?
CVE-2024-29988 is a security feature bypass vulnerability in Microsoft SmartScreen Prompt that allows malicious files to execute without triggering the security warnings normally shown for files downloaded from the internet. It bypasses the Mark of the Web (MotW) protection mechanism.
Why are SmartScreen bypass vulnerabilities dangerous?
SmartScreen is one of the primary defenses preventing users from accidentally executing malicious downloads. When bypassed, users receive no visual warning that a file is potentially dangerous, dramatically increasing the success rate of phishing and malware distribution campaigns.
Which Windows versions are affected?
Affected systems include Windows 10 (1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), and Windows Server 2019, 2022, and 2022 23H2. Apply the April 2024 cumulative updates to remediate the vulnerability.
How can I protect systems beyond patching?
Deploy application control policies using WDAC or AppLocker to prevent execution of unauthorized applications regardless of SmartScreen status. Implement email gateway filtering for suspicious file types, and enforce SmartScreen settings via Group Policy to prevent users from disabling the feature.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.