Take action now to plug Windows Themes vulnerability, says expert – Source: www.csoonline.com

Yet another vulnerability has popped up in the way Windows handles the Themes that employees download in hopes of getting a snazzier desktop. But an expert says the impact of the hole could be blunted simply by blocking a port.

The issue arose this week with a report from researchers at Acros Security of Slovenia, who said on their 0patch blog that Microsoft still hasn’t completely fixed a problem with malicious Windows Themes that allows Windows credentials to be sent via a crackable NTLM hash to a malicious server set up by a threat actor. Although Microsoft has issued two patches this year alone to fix the problem, Acros says it has found another vulnerability.

All versions of Windows at risk

The researchers say legacy and still-supported versions of Windows could be at risk until this latest vulnerability is patched.

Johannes Ullrich, dean of research at the SANS Institute, agrees it could be a problem if Windows administrators don’t block a port that allows connections to external file shares. But, he adds, they already should be doing this as part of good security. “There should be no reason a user on a network should ever connect to a Windows file share outside the network. That’s relatively easy to do: You need to block port 445 to prevent this from happening.”

“It’s not that terribly serious,” he said of the Acros discovery, “because most reasonably managed networks already block these outbound file share connections. If you don’t block them you probably have other [security] problems.”

Windows admins should also restrict NTLM traffic.

Another solution, Ullrich said, is reminding employees not to troll the internet for Windows Themes, as part of regular security awareness training.

Ullrich said the issue is that, when opening certain files including Windows Themes, the content may refer to additional external files. Think of an HTML page where images are loaded from another server. But if those additional files are hosted on a Windows file share, Windows automatically sends its credentials to log into that server. That’s how a malicious Windows Theme file tricks the user’s computer into sending credentials to the attacker.

 “The real problem is that this keeps coming back with all kinds of file types,” said Ullrich. “Last year it was with Outlook; when you opened an email, it was possible to trigger these downloads from malicious servers. It’s a recurring problem. Microsoft is playing whack-a-mole in eliminating all the different spots this could be happening.”

Compounding the problem is the fact that the user password that goes out is sent in an easily cracked NTLM hash, which Ullrich calls an “ancient algorithm.” However, he added, Microsoft disabled the NTLM capability in recent versions of Windows, so only older versions of the OS should be at risk.

Mike Walters, president and co-founder of Action1, which makes patch management solutions, called the issue serious because it affects all versions of Windows clients from Windows 7.

The vulnerability doesn’t require any special privileges to exploit, he noted, making it accessible to a wide range of potential attackers. It allows attackers to capture NTLM authentication hashes, potentially leading to further compromises if those hashes are cracked or used in pass-the-hash attacks, and it can be triggered simply by viewing a malicious theme file in Windows Explorer, requiring minimal user interaction, he noted. In some scenarios, he added, such as automatic downloads to the Downloads folder, users could unknowingly trigger the vulnerability.

The issue was found in different parts of the theme file handling process, he said, suggesting that there may be multiple areas where similar problems could occur. “The fact that several vulnerabilities were found in quick succession suggests that Microsoft’s initial fixes may not have been comprehensive enough, possibly due to time constraints or an underestimation of the complexity of the problem. Given the number of possible configurations and use cases for Windows themes, it may be difficult for Microsoft to test all possible scenarios thoroughly.” 

As Acros outlined in its blog, the history of spoofed Windows Themes goes back to last year, when Akamai researcher Tomer Peled found a vulnerability that would trigger the sending of a user’s NTLM credentials if a Theme file was viewed in Windows Explorer. “This meant that merely seeing a malicious theme file listed in a folder or placed on the desktop would be enough for leaking user’s credentials without any additional user action,” Acros notes.

Microsoft patched this issue, CVE-2024-21320, in January, adding that systems that have disabled NTLM aren’t affected. 

Another issue discovered

This doesn’t end the story. Tomer then found that the January Microsoft patch didn’t completely solve the problem. Microsoft responded with a new fix in July for this new vulnerability, CVE-2024-38030, which was rated as important in severity. Again, it reminded Windows admins to disable NTLM.

But Acros says the two patches don’t completely stop credentials from leaking. They found even a fully updated desktop running the most recent Windows 11 24H2 with both of these patches can be exploited by just copying a malicious theme file to the desktop.

Asked for comment, a Windows spokesperson said, “We’re aware of this report and will take action as needed to help keep customers protected.”