CVE-2024-21412

Name of the Vulnerable Software and Affected Versions Microsoft Windows 10 Microsoft Windows 11 Microsoft Windows Server 2016 through 2022

Description A security feature bypass exists in the handling of Internet Shortcut (.URL) files. The issue stems from a protection mechanism failure where Windows fails to correctly propagate Mark-of-the-Web (MotW) zone identifiers—a mechanism used to mark files downloaded from the internet as untrusted—when parsing these files. This allows attackers to bypass Microsoft Defender SmartScreen and other security warnings, enabling the silent delivery and execution of malware. Exploitation occurs when a user opens a specially crafted .URL file, which can be delivered via email, SharePoint, or network shares. In some cases, attackers use a double-shortcut technique where a file disguised as a .jpeg is actually a .url file that points to another shortcut to trigger the bypass. This flaw has been actively exploited in ransomware campaigns and by the APT group Water Hydra to deliver info-stealers and the DarkGate malware, often executing commands via rundll32.exe or ieframe.dll.

Recommendations Apply February 2024 Microsoft security updates (KB5034763, KB5034765, KB5034768, KB5034769 or later) for Windows 10, Windows 11, and Windows Server 2016 through 2022. Block .URL attachments at email gateways. Disable URL shortcut execution via Group Policy. Treat shortcut files as high-risk in Outlook.