CVE-2024-43451

CVE-2024-43451 is a flaw in the NTLM authentication implementation of Microsoft Windows that lets an attacker obtain a user's NTLMv2 authentication hash. It requires user interaction: a victim who engages with attacker-supplied content, such as a crafted file or an attacker-controlled file path/URL reference (consistent with the CWE-73 external control of file name weakness), causes Windows to silently initiate an NTLM authentication to a hostile host, leaking the hash. An attacker who captures the hash can crack it offline to recover the user's password or relay it to authenticate (spoof) as that user to other services, enabling credential theft and lateral movement. Any unpatched installation of the listed Windows 10, Windows 11, and Windows Server 2008/2012/2016/2019 versions is exposed, which covers essentially every mainstream Windows estate current in late 2024. Exploitation is confirmed: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-11-12, researchers have reported Russian-linked attackers using it in phishing campaigns delivering RAT malware, and EPSS assigns an 84.1% probability of exploitation within 30 days, though no public proof-of-concept code is known.

What to do: Apply Microsoft's November 2024 Patch Tuesday security updates (or later cumulative updates) to all listed Windows 10/11 client and Windows Server versions; the KEV listing makes patching mandatory for US federal agencies. As interim mitigation, block outbound SMB/HTTP NTLM authentication to untrusted destinations (e.g., firewall outbound TCP 445 from endpoints) and, where feasible, restrict NTLM in favor of Kerberos via Group Policy. Hunt for phishing emails containing crafted files and for unexpected outbound authentication attempts from workstations, and rotate credentials for accounts that may have authenticated to untrusted hosts before patching.