{"id":267,"date":"2024-09-17T11:23:51","date_gmt":"2024-09-17T11:23:51","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=267"},"modified":"2024-09-17T11:23:51","modified_gmt":"2024-09-17T11:23:51","slug":"microsoft-re-categorizes-fixed-trident-bug-as-zero-day","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=267","title":{"rendered":"Microsoft re-categorizes fixed Trident bug as zero day"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

A recently patched Windows MSHTML (Trident) Platform Spoofing Vulnerability had zero day<\/a> exploitations since before July 2024, in conjunction with another MSHTML spoofing bug, according to Microsoft.<\/p>\n

Fixed in this month\u2019s Patch Tuesday update, CVE-2024-43461 is a critical (CVSS 8.8\/10) user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page, according to a CISA advisory<\/a>.<\/p>\n

\u201cCVE-2024-43461 was exploited as a part of an attack chain relating to CVE-2024-38112, prior to July 2024,\u201d Microsoft said in the recent update to its advisory<\/a> on the bug. \u201cWe released a fix for CVE-2024-38112 in our July 2024 security updates which broke this attack chain.\u201d<\/p>\n

Trident is Microsoft\u2019s legacy web browser engine, which served as the foundational technology for the brand\u2019s browsing strategies in the late 1990s and 2000s. The engine was launched as part of the Internet Explorer 4.0 release to provide embedded web functionalities and is still carried within Windows rollouts for backward compatibility purposes.<\/p>\n

Exploitation by Void Banshee APT<\/h2>\n

Microsoft attributed the discovery of CVE-2024-43461 to Peter Girnus, senior cyber threat researcher at Trend Micro\u2019s Zero Day Initiative (ZDI).<\/p>\n

Trend Micro also discovered CVE-2024-38112 in May, the MSHTML remote code execution (RCE) vulnerability that attackers used along with CVE-2024-43461 in their attack chain.<\/p>\n

\u201cCVE-2024-38112 was used as part of an attack chain by the advanced persistent threat (APT<\/a>) group Void Banshee, which targets North American, European, and Southeast Asian regions for information theft and financial gain.\u201d Trend Micro had said in a July blog post<\/a>.<\/p>\n

The attack chain that exploited CVE-2024-38112 leveraged the CVE-2024-43461 to create a CWE-451 condition, UI misrepresentation of critical information, according to Girnus.<\/p>\n

Void Banshee\u2019s second MS zero day<\/h2>\n

Trend Micro\u2019s analysis is in line with Check Point researcher Haifei Li\u2019s claims that Void Banshee<\/a> exploited the vulnerability in a spear-phishing<\/a> campaign to distribute the Atlantida Stealer, which extracts system information and sensitive data like passwords and cookies from different applications. Microsoft had attributed Li to discovering CVE-2024-38112.<\/p>\n

\u201cSpecifically, the attackers used special Windows Internet Shortcut files (.url extension name), which, when clicked, would call the retired Internet Explorer (IE) to visit the attacker-controlled URL,\u201d explained Li in a July Check Point Research report<\/a>.<\/p>\n

The URLs were employed to download a malicious HTA file and prompt the user to open it. Once opened, a script is executed to install the Atlantida info-stealer.<\/p>\n

These HTA files also exploited CVE-2024-43461 to conceal the HTA file extension and make it appear as a PDF when Windows asked users if the file should be opened. The fix from Microsoft, when applied, will allow Windows to show the actual .hta extension, thereby alerting users against the malicious download.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

A recently patched Windows MSHTML (Trident) Platform Spoofing Vulnerability had zero day exploitations since before July 2024, in conjunction with another MSHTML spoofing bug, according to Microsoft. Fixed in this month\u2019s Patch Tuesday update, CVE-2024-43461 is a critical (CVSS 8.8\/10) user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a […]<\/p>\n","protected":false},"author":0,"featured_media":268,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-267","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/267"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=267"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/267\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/268"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=267"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=267"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=267"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}