CVE-2024-38213
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
Description
CVE-2024-38213 is a medium-severity security feature bypass vulnerability in the Windows Mark of the Web (MotW) mechanism, carrying a CVSS v3.1 base score of 6.5. The flaw allows a remote attacker to craft content that bypasses the Mark of the Web protections, which normally trigger SmartScreen warnings and Protected View in Microsoft Office when users open files downloaded from the internet. CISA has added CVE-2024-38213 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 3, 2024, and the ransomware association is classified as unknown. With an EPSS score of 59.32% at the 98.2nd percentile, this vulnerability is extremely actively exploited. The vulnerability affects all major Windows versions including Windows 10, Windows 11, and Windows Server 2012 through 2022.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20680 |
| microsoft | windows 10 1607 | < 10.0.14393.7070 |
| microsoft | windows 10 1809 | < 10.0.17763.5936 |
| microsoft | windows 10 21h2 | < 10.0.19044.4529 |
| microsoft | windows 10 22h2 | < 10.0.19045.4529 |
| microsoft | windows 11 21h2 | < 10.0.22000.3019 |
| microsoft | windows 11 22h2 | < 10.0.22621.3737 |
| microsoft | windows 11 23h2 | < 10.0.22631.3737 |
| microsoft | windows server 2012 | < 6.2.9200.24919; r2 |
| microsoft | windows server 2016 | < 10.0.14393.7070 |
| microsoft | windows server 2019 | < 10.0.17763.5936 |
| microsoft | windows server 2022 | < 10.0.20348.2522 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.950 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38213(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38213(US Government Resource)
Weakness Type
Mark of the Web Security Feature Bypass
CVE-2024-38213 targets the Windows Mark of the Web (MotW) security mechanism, a fundamental defense layer in the Windows security model. When a file is downloaded from the internet or received as an email attachment, Windows applies an Alternate Data Stream (ADS) tag called Zone.Identifier that marks the file as originating from an untrusted source. This mark triggers security measures including SmartScreen reputation checks, Office Protected View, and macro execution restrictions. A bypass of this mechanism removes these critical security gates, allowing malicious files to execute without the warnings and sandboxing that users and organizations rely on. MotW bypasses are particularly dangerous because they undermine defense-in-depth strategies that depend on the initial trust classification of downloaded content.
Impact Analysis
The business impact of CVE-2024-38213 is significant, particularly for its role in enabling attack chains. Confidentiality is not directly impacted (C:N in the CVSS vector), as the bypass itself does not expose data. However, by removing MotW protections, it enables subsequent payloads to execute unrestricted, which can lead to full confidentiality compromise through downstream exploitation.
Integrity faces high impact (I:H) because the vulnerability fundamentally breaks the trust classification system that Windows uses to distinguish between safe and potentially dangerous files. Files that should be treated as untrusted are instead processed as if they originated from a trusted source, bypassing SmartScreen checks, Office Protected View restrictions, and macro security policies.
Availability is not directly affected (A:N), but the downstream impact of successful exploitation through malware delivery can include ransomware deployment and system destruction. The network attack vector (AV:N) combined with no privileges required (PR:N) makes this vulnerability particularly dangerous for phishing campaigns. The user interaction requirement (UI:R) means a user must open the crafted content, but social engineering makes this achievable at scale. The EPSS score of 59.32% at the 98.2nd percentile confirms that this vulnerability is among the most heavily exploited, reflecting its value to threat actors as a gateway bypass for malware delivery.
Exploit Maturity
CVE-2024-38213 has achieved extremely high exploit maturity with confirmed widespread active exploitation. CISA has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of September 3, 2024. The EPSS score of 59.32% at the 98.2nd percentile places it among the most actively exploited vulnerabilities, reflecting its enormous value to attackers who rely on bypassing Windows security controls.
Microsoft has acknowledged exploitation in the wild through its security advisory. MotW bypass vulnerabilities are consistently among the most sought-after and exploited classes of Windows vulnerabilities because they serve as enablers for entire attack chains. By neutralizing SmartScreen and Protected View, attackers can deliver malicious Office documents, executables, and scripts that execute without security warnings. The ransomware association is classified as unknown, but MotW bypasses are well-documented components of commodity malware distribution campaigns, including those delivering ransomware, information stealers, and remote access trojans.
Remediation
-
Apply the Microsoft security updates immediately. Install the update from the Microsoft Security Response Center advisory that addresses the MotW bypass. Given the extremely high EPSS score and active exploitation, this patch should be deployed as rapidly as possible across all affected Windows systems.
-
Reinforce email and web gateway filtering. Since CVE-2024-38213 requires user interaction to open crafted content, blocking malicious files at the email and web gateway level reduces exposure. Configure mail filters to strip or quarantine suspicious attachments, particularly archive formats that are commonly used to bypass MotW (ZIP, ISO, IMG, VHD). Block downloads of high-risk file types from untrusted sources.
-
Enforce Attack Surface Reduction rules. Enable Microsoft Defender Attack Surface Reduction (ASR) rules that restrict Office applications from creating child processes, block execution of potentially obfuscated scripts, and prevent untrusted processes from launching. These rules provide defense-in-depth even when MotW protections are bypassed.
-
Educate users about social engineering tactics. Since exploitation requires the user to open malicious content (UI:R), security awareness training focused on identifying phishing emails, suspicious downloads, and unexpected file types reduces the success rate of exploitation campaigns leveraging this vulnerability.
-
Monitor for exploitation indicators. Watch for files being opened or executed without the expected MotW Zone.Identifier alternate data stream. Track SmartScreen bypass events in Windows Defender logs and investigate instances where downloaded files execute without triggering expected security prompts.
Technical Details
CVE-2024-38213 carries a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, resulting in a medium base score of 6.5. The attack vector is network (AV:N), meaning the attacker delivers the exploit remotely, typically through email attachments or malicious downloads. The attack complexity is low (AC:L), indicating reliable exploitation without special conditions. No privileges (PR:N) are required on the target system, but user interaction (UI:R) is needed, specifically the user must open the crafted file.
The vulnerability targets the Windows Mark of the Web implementation, which relies on NTFS Alternate Data Streams (ADS) to tag downloaded files with a Zone.Identifier that records the file's origin zone (typically Zone 3 for the Internet). When a file carries this tag, Windows and applications like Microsoft Office apply additional security measures before allowing the content to execute or open fully. CVE-2024-38213 exploits a flaw in how Windows processes or propagates the MotW tag under certain conditions, allowing an attacker to craft content that either does not receive the MotW tag during download or loses it during processing. The integrity impact is high (I:H) because the core trust classification mechanism is defeated, while confidentiality and availability impacts are none because the bypass itself does not directly expose data or disrupt services. The scope is unchanged (S:U). Affected versions include Windows 10 1507 through 22H2, Windows 11 21H2 through 23H2, and Windows Server 2012 through 2022 23H2.
Frequently Asked Questions
What is CVE-2024-38213?
CVE-2024-38213 is a medium-severity security feature bypass vulnerability in the Windows Mark of the Web mechanism. It allows attackers to craft files that evade SmartScreen warnings and Office Protected View when opened by users, effectively removing critical security gates for downloaded content. It has a CVSS score of 6.5.
Why is a medium-severity vulnerability in the KEV catalog?
Although CVE-2024-38213 has a base CVSS score of only 6.5, its real-world impact is amplified because it serves as an enabler for entire attack chains. By bypassing MotW protections, attackers can deliver malicious payloads that execute without security warnings, making it extremely valuable for phishing and malware campaigns. The EPSS score of 59.32% confirms massive exploitation.
How does CVE-2024-38213 relate to phishing attacks?
MotW bypass vulnerabilities like CVE-2024-38213 are frequently used in phishing campaigns to deliver malicious Office documents, scripts, or executables. Normally, these files would trigger SmartScreen warnings or open in Protected View. With the bypass, victims receive no security warnings, dramatically increasing the success rate of social engineering attacks.
What file types are most commonly used to exploit CVE-2024-38213?
Attackers typically use archive formats (ZIP, RAR), disk image files (ISO, IMG, VHD), and container formats that can strip or fail to propagate the MotW tag. These formats are combined with social engineering to convince users to open the contained malicious files.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.