CVE-2024-43573
Microsoft Windows MSHTML Platform Spoofing Vulnerability
Description
CVE-2024-43573 is a medium-severity spoofing vulnerability in the Windows MSHTML Platform, the legacy rendering engine that underpins Internet Explorer and is still used by numerous Windows applications for HTML content processing. An attacker can exploit this flaw by luring a victim into interacting with specially crafted web content, enabling the attacker to present misleading information that appears authentic to the user. With a CVSS v3.1 base score of 6.5 and an attack vector requiring user interaction over the network, the vulnerability affects a broad range of Windows versions including Windows 10, Windows 11, and Windows Server 2012 through 2022. CISA has added CVE-2024-43573 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 29, 2024, and its EPSS score of 18.56% at the 95.1st percentile underscores significant real-world exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20796 |
| microsoft | windows 10 1607 | < 10.0.14393.7428 |
| microsoft | windows 10 1809 | < 10.0.17763.6414 |
| microsoft | windows 10 21h2 | < 10.0.19044.5011 |
| microsoft | windows 10 22h2 | < 10.0.19045.5011 |
| microsoft | windows 11 21h2 | < 10.0.22000.3260 |
| microsoft | windows 11 22h2 | < 10.0.22621.4317 |
| microsoft | windows 11 23h2 | < 10.0.22631.4317 |
| microsoft | windows 11 24h2 | < 10.0.26100.2033 |
| microsoft | windows server 2012 | r2 |
| microsoft | windows server 2016 | < 10.0.14393.7428 |
| microsoft | windows server 2019 | < 10.0.17763.6414 |
| microsoft | windows server 2022 | < 10.0.20348.2762 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1189 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43573(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43573(US Government Resource)
Weakness Type
MSHTML Platform Spoofing
CVE-2024-43573 is classified as a spoofing vulnerability in the Windows MSHTML Platform. Spoofing vulnerabilities allow an attacker to disguise the origin, identity, or content of information presented to a user, causing the victim to trust malicious content as legitimate. The MSHTML Platform (also known as Trident) is the rendering engine behind Internet Explorer and continues to be invoked by many Windows applications for HTML parsing, MHTML rendering, and ActiveX hosting. Despite Internet Explorer's end-of-life, the MSHTML engine remains deeply integrated into the Windows operating system. In this vulnerability, the platform fails to properly validate or display content origin information, allowing an attacker to craft content that visually impersonates trusted sources. This can lead to credential theft, social engineering, or the execution of further attack stages when users interact with the spoofed content.
Impact Analysis
Confidentiality is the primary impact area for CVE-2024-43573, rated as high in the CVSS vector. By successfully spoofing content through the MSHTML Platform, an attacker can trick users into disclosing sensitive information such as credentials, personal data, or security tokens. Because the MSHTML engine is embedded in many Windows applications beyond just the browser, the spoofing surface extends to email clients, document viewers, and any application that renders HTML content via the platform. The attack requires user interaction (UI:R), meaning the victim must open a malicious document or click a crafted link, but modern social engineering techniques make this barrier relatively low.
Integrity and availability are not directly affected according to the CVSS scoring, as the vulnerability does not allow the attacker to modify system data or disrupt services on its own. However, the information obtained through spoofing can serve as a launching pad for more severe attacks, including credential-based account compromise or lateral movement. The EPSS score of 18.56% at the 95.1st percentile is notably high for a medium-severity vulnerability, indicating that threat actors are actively exploiting it in the wild. While ransomware association remains unknown, the MSHTML Platform has been a recurring target for advanced persistent threat groups due to its deep integration across the Windows ecosystem.
Exploit Maturity
CVE-2024-43573 has confirmed active exploitation in the wild, as demonstrated by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a federal remediation deadline of October 29, 2024. The EPSS score of 18.56% at the 95.1st percentile places this vulnerability among the top 5% of all CVEs for exploitation probability, a remarkably high figure for a spoofing vulnerability with a medium base score.
Microsoft has published a security update through the Microsoft Security Response Center addressing this vulnerability. The MSHTML Platform has been a frequent target for zero-day exploitation campaigns, with several related vulnerabilities exploited in recent years including CVE-2024-38112 and CVE-2021-40444. Attackers typically deliver exploits via phishing emails containing malicious Office documents or specially crafted URLs that invoke the MSHTML engine. The no-privilege-required (PR:N) and network-accessible (AV:N) nature of the vulnerability makes it particularly attractive for mass exploitation campaigns. While CISA lists the ransomware association as unknown, MSHTML spoofing vulnerabilities are commonly used as initial access vectors in multi-stage attack chains.
Remediation
-
Apply the October 2024 Windows security updates immediately. Install the patches provided by Microsoft through the Security Update Guide for CVE-2024-43573. This addresses the spoofing vulnerability in the MSHTML Platform across all affected Windows versions including Windows 10, Windows 11, and Windows Server editions.
-
Restrict MSHTML and Internet Explorer legacy components. Where operationally feasible, disable the Internet Explorer integration and MSHTML-based rendering in your environment. Use Group Policy to force applications to use modern rendering engines instead of the legacy MSHTML Platform. Apply the Microsoft-recommended IE mode restrictions in Microsoft Edge.
-
Implement email and web content filtering. Since exploitation requires user interaction with malicious content, deploy advanced email filtering to block phishing emails containing malicious HTML, MHTML attachments, or links to attacker-controlled content. Configure web proxies to block known malicious domains and enforce URL filtering policies.
-
Educate users on spoofing and phishing risks. Train users to recognize suspicious content, particularly documents or links that invoke the MSHTML engine. Emphasize that content may appear to originate from trusted sources while actually being attacker-controlled, and encourage reporting of suspicious communications.
-
Monitor for indicators of compromise. Review endpoint detection logs for unusual MSHTML process spawning, particularly mshta.exe or iexplore.exe launching from unexpected parent processes such as Office applications. Implement detection rules for known MSHTML exploitation patterns and monitor for post-exploitation lateral movement.
Technical Details
CVE-2024-43573 carries a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, yielding a base score of 6.5 (Medium). The vector indicates a network-accessible attack (AV:N) with low complexity (AC:L) that requires no privileges (PR:N) but does require user interaction (UI:R), meaning the victim must open a malicious file or navigate to attacker-controlled content.
The vulnerability resides in the MSHTML Platform (Trident engine), which is the legacy HTML rendering engine embedded in Windows. Despite Internet Explorer reaching end-of-life, the MSHTML Platform persists as a core Windows component because numerous applications rely on it for HTML parsing, MHTML rendering, and COM-based HTML document handling. The spoofing flaw occurs when the MSHTML engine processes specially crafted content that manipulates how origin information or content identity is presented to the user. This can involve techniques such as URL obfuscation in the address bar, misleading document properties in MHTML files, or content rendering that visually disguises the true source of information.
The scope is unchanged (S:U), meaning the vulnerability's impact is confined to the MSHTML component itself and does not directly affect other system components. The confidentiality impact is high (C:H) because successful spoofing can lead to full disclosure of sensitive information when users interact with the deceptive content. Integrity (I:N) and availability (A:N) are not affected, as the vulnerability does not enable data modification or service disruption on its own. Affected systems span the entire supported Windows desktop and server lineup, including Windows 10 versions 1507 through 22H2, Windows 11 versions 21H2 through 24H2, and Windows Server 2012 R2 through 2022 23H2.
Frequently Asked Questions
What is CVE-2024-43573?
CVE-2024-43573 is a spoofing vulnerability in the Windows MSHTML Platform, the legacy HTML rendering engine used by Internet Explorer and many Windows applications. It allows an attacker to present misleading content that appears to come from a trusted source, potentially tricking users into disclosing sensitive information. The vulnerability has a CVSS score of 6.5 and is actively exploited in the wild.
Why is a medium-severity vulnerability in CISA's KEV catalog?
While the base CVSS score of 6.5 is medium, active exploitation in the wild is the primary criterion for inclusion in CISA's Known Exploited Vulnerabilities catalog. The MSHTML Platform is a high-value target because it is embedded across the entire Windows ecosystem, and spoofing vulnerabilities serve as effective initial access vectors in sophisticated attack chains that lead to far more damaging outcomes.
Is my system affected even if I don't use Internet Explorer?
Yes. The MSHTML Platform (Trident engine) is a core Windows component that operates independently of the Internet Explorer browser. Many applications including Microsoft Office, Outlook, and third-party software invoke the MSHTML engine for HTML content rendering. Even with Internet Explorer disabled or uninstalled, the underlying MSHTML Platform remains present and potentially vulnerable.
How are attackers exploiting CVE-2024-43573?
Attackers typically deliver exploits through phishing emails containing specially crafted HTML or MHTML documents, or through malicious links that trigger MSHTML rendering. The spoofed content presents itself as legitimate, tricking users into entering credentials or performing actions that benefit the attacker. This vulnerability is often used as the first step in multi-stage attack campaigns.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.