Security Affairs newsletter Round 485 by Pierluigi Paganini

CVE-2024-38213 is a security feature bypass in the Windows Mark of the Web (MotW) mechanism that underpins SmartScreen warnings, allowing a maliciously crafted file to bypass the usual 'file downloaded from the internet' prompt. It is triggered when a user opens attacker-supplied content that defeats or strips the MotW flag, meaning the exploit requires user interaction (CVSS UI:R) and a network-accessible delivery vector such as email or a web download. On its own the flaw grants no confidentiality or availability impact but high integrity impact (CVSS 3.1 score 6.5), and in practice it is used to evade SmartScreen protections, typically chained with other bugs to achieve fuller compromise. It affects an extremely broad population: Windows 10 (1507 through 22H2), Windows 11 (21H2 through 23H2), and Windows Server 2012 through 2022. The flaw was one of six zero-days under active attack in Microsoft's August 2024 Patch Tuesday release and was added to CISA's Known Exploited Vulnerabilities catalog on 2024-08-13; EPSS puts its 30-day exploitation probability at 13.6% (96th percentile).

Do: Apply the August 2024 Microsoft security updates (Patch Tuesday, released 2024-08-13) for every affected Windows 10, Windows 11, and Windows Server version, per CISA's KEV required action; treat this as a priority patch given confirmed in-the-wild exploitation. Because the bypass requires a user to open attacker-supplied content, reinforce caution around emailed and downloaded files until patching is complete, and confirm from vendor guidance whether any interim mitigations apply in environments that cannot patch immediately.