Very High
CVE-2024-43451
CVE-2024-43451
Add Assessment
Technical Analysis
CVE-2024-43451 is a Windows NTLM hash disclosure vulnerability categorized as a “spoofing” flaw that affects all supported Microsoft Windows versions, including Windows 10, Windows 11, and Windows Server editions.
The vulnerability stems from how Windows handles Internet Shortcut (.URL) files, exploiting a weakness in the outdated MSHTML (Internet Explorer) engine still present in the OS.
An attacker can craft a malicious .URL file pointing to a network path (UNC) hosted on an attacker-controlled server. When Windows Explorer or related components interact with this file, the system automatically attempts to retrieve remote resources over SMB, triggering an NTLM authentication handshake without requiring user approval.
Essentially, as soon as the file is engaged, Windows “calls out” to the attacker’s SMB server, sending the user’s NTLMv2 hash (hashed credentials) for authentication.
The vulnerability arises because seemingly harmless file interactions—such as previewing, moving, or right-clicking a .URL shortcut—cause the Windows shell to invoke the MSHTML/Explorer subsystem to fetch external content, such as an icon or target path.
Since the path can be a remote SMB share (file:// URI or UNC), Windows automatically performs NTLM authentication with that remote server, unknowingly leaking the NTLMv2 password hash to the attacker.
This flaw does not execute arbitrary code directly but compromises confidentiality by exposing credentials.
With the stolen hash, an attacker can impersonate the user on a network by performing a pass-the-hash attack, allowing them to authenticate without needing the user’s plaintext password.
CVSS V3 Severity and Metrics
General Information
Vendors
Products
- windows 10 1507,
- windows 10 1607,
- windows 10 1809,
- windows 10 21h2,
- windows 10 22h2,
- windows 11 22h2,
- windows 11 23h2,
- windows 11 24h2,
- windows server 2008 -,
- windows server 2008 r2,
- windows server 2012 -,
- windows server 2012 r2,
- windows server 2016,
- windows server 2019,
- windows server 2022,
- windows server 2022 23h2,
- windows server 2025
Weaknesses
Exploited in the Wild
