Microsoft

Microsoft on Tuesday disclosed that three new security flaws impacting the Windows platform have come under active exploitation as part of its Patch Tuesday update for September 2024.

The monthly security release addresses a total of 79 vulnerabilities, of which seven are rated Critical, 71 are rated Important, and one is rated Moderate in severity. This is aside from 26 flaws that the tech giant resolved in its Chromium-based Edge browser since last month's Patch Tuesday release.

The three vulnerabilities that have been weaponized in a malicious context are listed below, alongside a bug that Microsoft is treating as exploited -

  • CVE-2024-38014 (CVSS score: 7.8) - Windows Installer Elevation of Privilege Vulnerability
  • CVE-2024-38217 (CVSS score: 5.4) - Windows Mark-of-the-Web (MotW) Security Feature Bypass Vulnerability
  • CVE-2024-38226 (CVSS score: 7.3) - Microsoft Publisher Security Feature Bypass Vulnerability
  • CVE-2024-43491 (CVSS score: 9.8) - Microsoft Windows Update Remote Code Execution Vulnerability

"Exploitation of both CVE-2024-38226 and CVE-2024-38217 can lead to the bypass of important security features that block Microsoft Office macros from running," Satnam Narang, senior staff research engineer at Tenable, said in a statement.

Cybersecurity

"In both cases, the target needs to be convinced to open a specially crafted file from an attacker-controlled server. Where they differ is that an attacker would need to be authenticated to the system and have local access to it to exploit CVE-2024-38226."

As disclosed by Elastic Security Labs last month, CVE-2024-38217 – also referred to as LNK Stomping – is said to have been abused in the wild as far back as February 2018.

CVE-2024-43491, on the other hand, is notable for the fact that it's similar to the downgrade attack that cybersecurity company SafeBreach detailed early last month.

"Microsoft is aware of a vulnerability in Servicing Stack that has rolled back the fixes for some vulnerabilities affecting Optional Components on Windows 10, version 1507 (initial version released July 2015)," Redmond noted.

"This means that an attacker could exploit these previously mitigated vulnerabilities on Windows 10, version 1507 (Windows 10 Enterprise 2015 LTSB and Windows 10 IoT Enterprise 2015 LTSB) systems that have installed the Windows security update released on March 12, 2024 — KB5035858 (OS Build 10240.20526) or other updates released until August 2024."

The Windows maker further said it can be resolved by installing the September 2024 Servicing stack update (SSU KB5043936) and the September 2024 Windows security update (KB5043083), in that order.

It's also worth pointing out that Microsoft's "Exploitation Detected" assessment for CVE-2024-43491 stems from the rollback of fixes that addressed vulnerabilities impacting certain Optional Components for Windows 10 (version 1507), some of which have been previously exploited.

"No exploitation of CVE-2024-43491 itself has been detected," the company said. "In addition, the Windows product team at Microsoft discovered this issue, and we have seen no evidence that it is publicly known."

Cybersecurity

Software Patches from Other Vendors

In addition to Microsoft, security updates have also been released by other vendors over the past few weeks to rectify several vulnerabilities, including —

Update

Microsoft on Friday updated the advisory for CVE-2024-43461 to reveal that the vulnerability has been actively exploited in the wild by a threat actor known as Void Banshee, bringing the tally to four zero-day bugs that were patched by the company this month.

The vulnerability, tracked as CVE-2024-43461 (CVSS score: 8.8), has been characterized as an MSHTML platform spoofing vulnerability similar to CVE-2024-38112, which was exploited by the threat actor to deliver Atlantida stealer malware.

"CVE-2024-43461 was exploited as a part of an attack chain relating to CVE-2024-38112, prior to July 2024," Microsoft noted in the bulletin. "We released a fix for CVE-2024-38112 in our July 2024 security updates which broke this attack chain."

The disclosure comes as SEC Consult revealed details of CVE-2024-38014, a privilege escalation flaw in the Windows Installer component that could enable a malicious actor to gain SYSTEM privileges.

"The MSI file format allows to create standardized installers that can install, remove, and repair software," security researcher Michael Baer said. "While the installation and removal of software usually requires elevated permissions, the repair function for already installed software can be performed by a low-privileged user.

"The issued repair functions can, however, be executed under the context of NT AUTHORITY\SYSTEM, a very high access right in Windows. If an attacker is able to maliciously interfere with those functions, a privilege escalation attack is possible."

However, there are a few caveats: The exploit requires GUI access and a supported browser, such as Google Chrome or Mozilla Firefox. It does not work on recent versions of Microsoft's Edge browser.

(The story was updated after publication on September 16, 2024, to reflect the active exploitation of CVE-2024-43461.)


Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.