Internet Shortcut Files Security Feature Bypass Vulnerability CVE-2024-21412

Introduction

CVE-2024-21412, an Internet Shortcut Files Security Feature Bypass Vulnerability, has recently been highlighted as a potential threat to Windows users. The vulnerability allows attackers to bypass certain security features and execute malicious code via specially crafted Internet Shortcut (.url) files. In this blog, we will dive deep into understanding the vulnerability, its implications, how attackers can exploit it, and steps to mitigate the issue. Additionally, we’ll provide a PowerShell script to assist in detecting and neutralizing vulnerable shortcut files within your environment.

What is CVE-2024-21412?

Overview

CVE-2024-21412 exploits a security feature bypass in Internet Shortcut files used in Windows. Attackers can use malicious “.url” files to execute payloads without triggering standard security defenses, such as application control policies or user consent prompts. These files can be delivered via email attachments, shared network locations, or websites.

Affected Systems

Windows 10 (all builds prior to December 2024 updates)

Windows 11 (all builds prior to December 2024 updates)

Windows Server 2016, 2019, and 2022

Systems without the latest security patches are most vulnerable. Network environments with misconfigured policies and inadequate monitoring are particularly susceptible.

Impact

When executed, the malicious shortcut file can:

Download and execute payloads, including ransomware, spyware, or keyloggers.

Establish a connection to a Command and Control (C2) server.

Exfiltrate sensitive information such as login credentials or system data.

Exploitation Methodology

Crafting Malicious Shortcut Files:
The attacker creates a “.url” file with a payload URL linking to a malicious executable. The shortcut may appear benign to users, mimicking legitimate file names or icons.

Delivery Mechanisms:
These files are distributed through phishing emails, shared network drives, or USB drives.

Execution:
When the user clicks on the shortcut, the system bypasses standard security warnings and executes the malicious code linked in the file.

Payload Execution:
The payload delivered through the URL is executed, compromising the machine and potentially spreading across the network.

How to Mitigate CVE-2024-21412

Apply Microsoft’s Security Patch

Microsoft has released patches addressing this vulnerability. Ensure your systems are updated with the latest cumulative updates for:

Windows 10

Windows 11

Windows Server (2016, 2019, 2022)

Run the following commands in PowerShell to check for and apply updates:

# Check for updates
Install-Module -Name PSWindowsUpdate -Force
Import-Module PSWindowsUpdate
Get-WindowsUpdate

# Install updates
Install-WindowsUpdate -AcceptAll -AutoReboot

Enforce Group Policies

Leverage Group Policy settings to restrict the execution of Internet Shortcut files.

1. Open the Group Policy Editor (gpedit.msc).

2. Navigate to: User Configuration > Administrative Templates > Windows Components > File Explorer.

Enable the following policies:

“Do not allow executable files to run from user profiles.”

“Turn off Internet Shortcut file execution.”

Restrict URL Execution

Implement URL filtering at the firewall or proxy level to block access to suspicious domains associated with shortcut payloads.

Educate Users

Conduct training to help users identify suspicious files and avoid executing attachments or shortcuts from untrusted sources.

Detection and Remediation Using PowerShell

Script to Detect and Neutralize Malicious Shortcut Files

The following PowerShell script scans directories for suspicious “.url” files and neutralizes them by converting their contents to plain text, rendering them harmless:

# Script to detect and neutralize malicious URL shortcut files

# Define directories to scan
$directoriesToScan = @(
“$env:USERPROFILE\Downloads”,
“$env:USERPROFILE\Desktop”,
“$env:USERPROFILE\Documents”,
“C:\Shared\”,
“C:\Temp\”
)

# Log file to store scan results
$logFile = “C:\Malicious_URL_Scan.log”

# Function to analyze URL files
Function Analyze-Shortcut {
param (
[string]$filePath
)

Write-Output “Scanning file: $filePath” | Out-File -Append -FilePath $logFile

# Read the URL file
try {
$content = Get-Content -Path $filePath -ErrorAction Stop
if ($content -match “^URL=”) {
$url = ($content -match “URL=(.+)” | Out-Null; $matches[1])
Write-Output “Detected URL: $url” | Out-File -Append -FilePath $logFile

# Check for suspicious domains (add your own domains here)
if ($url -match “(examplemalicious\.com|badactor\.net)”) {
Write-Output “Malicious URL detected in: $filePath” | Out-File -Append -FilePath $logFile

# Neutralize the file
Set-Content -Path $filePath -Value “[Neutralized by Security Script]”
Write-Output “Neutralized file: $filePath” | Out-File -Append -FilePath $logFile
}
}
} catch {
Write-Output “Error reading file: $filePath. Error: $_” | Out-File -Append -FilePath $logFile
}
}

# Main scan loop
foreach ($directory in $directoriesToScan) {
if (Test-Path $directory) {
Write-Output “Scanning directory: $directory” | Out-File -Append -FilePath $logFile

# Get all .url files in the directory
$urlFiles = Get-ChildItem -Path $directory -Recurse -Filter “*.url” -ErrorAction SilentlyContinue
foreach ($file in $urlFiles) {
Analyze-Shortcut -filePath $file.FullName
}
} else {
Write-Output “Directory does not exist: $directory” | Out-File -Append -FilePath $logFile
}
}

Write-Output “Scan complete. Results saved in $logFile” | Out-File -Append -FilePath $logFile

How It Works

1. Directories to Scan: The script targets common directories like Downloads, Desktop, and Documents. You can add or modify paths as per your environment.

2. Detection: It scans “.url” files, extracts their URLs, and checks against known malicious domains.

3. Neutralization: If a file is identified as malicious, it replaces its content with a harmless placeholder message.

4. Logging: The script logs all actions in a specified log file for auditing purposes.

Running the Script

Save the script as ScanAndNeutralizeShortcut.ps1.

Run the script with administrator privileges:

PowerShell.exe -File ScanAndNeutralizeShortcut.ps1

Review the log file for results.