Windows Themes Spoofing Vulnerability: A New Threat to User Privacy

Summary

The Windows Themes Spoofing Vulnerability, identified as CVE-2024-21320 with a CVSS score of 6.5, allows attackers to coerce victims into sending credentials, typically in the form of NTLM hashes over SMB, to the attacker’s server. This is triggered when a victim views a Theme file in Explorer, causing SMB handshake packets containing credentials to be sent to the attacker's server. All Windows versions are affected as Themes is a built-in feature in the Windows operating system. Microsoft released a patch for this vulnerability in January 2024. The potential impact includes NTLM relay attacks, credential stuffing, and unauthorized access. It is important for organizations to update their endpoints with the latest security patch to mitigate the risk.

News Articles

Akamai

CVE-2024-21320

Leaking NTLM Credentials Through Windows Themes | Akamai

In this latest piece of research by Tomer Peled, see how a seemingly innocuous personalization option can trigger an authentication coercion.

6 months ago