Advertisements
CVE-2025-24054 is a high-severity NTLM authentication vulnerability that allows attackers to leak NTLMv2-SSP (Security Support Provider) hashes through spoofing techniques. The exploitation relies on maliciously crafted .library-ms files, which can force Windows Explorer to initiate SMB authentication requests to an attacker-controlled server, exposing user credentials. This vulnerability poses serious risks, enabling credential theft, lateral movement, and unauthorized system access.
Technical Overview
1. Affected Systems
- All supported versions of Windows (including Windows Server editions) are vulnerable.
- Microsoft released an official security patch on March 11, 2025, addressing the flaw.
- Despite the patch, attackers began actively exploiting the vulnerability within eight days, launching real-world attacks.
2. Root Cause of the Vulnerability
- This vulnerability stems from improper session management within NTLM authentication over SMB (Server Message Block).
- A specially crafted
.library-msfile (a Windows Library file) is used to trigger an unauthorized NTLM authentication request, leading the system to disclose NTLMv2-SSP hashes to a remote attacker-controlled server. - These hashes can then be brute-forced offline or used directly in pass-the-hash (PtH) attacks to bypass authentication mechanisms.
3. Exploitation Mechanism
Malicious .library-ms File Deployment:
- Attackers distribute
.library-msfiles via phishing emails, compromised websites, or shared file archives. - The file doesn’t need to be opened—merely navigating to a folder containing the file triggers the exploit.
Automatic SMB Authentication Initiation:
- When a user interacts with the
.library-msfile (right-click, drag, or browse), Windows Explorer silently initiates an SMB authentication request to the attacker’s remote SMB server. - This interaction results in the victim’s NTLMv2-SSP hash being sent to the attacker.
Credential Theft and Brute Force Attacks:
- The attacker captures the NTLM hash and can:
- Attempt offline brute-force attacks to retrieve the plaintext password.
- Use pass-the-hash techniques to authenticate on other systems without needing the password itself.
- Relay NTLM authentication requests to escalate access privileges within an organization’s network.
Observed Attack Campaigns
- March 20–21, 2025: A targeted campaign affected government agencies and private organizations in Poland and Romania.
- Attackers used Dropbox-hosted archives containing malicious
.library-msfiles to harvest NTLM hashes. - Collected credentials were transmitted to attack servers located in Russia, Bulgaria, the Netherlands, Australia, and Turkey.
- Security researchers confirmed weaponized exploits were circulating in underground forums, indicating widespread adoption of this technique.
Potential Impact of CVE-2025-24054
1. Unauthorized Credential Theft
- Any user whose NTLM hash is leaked becomes vulnerable to account compromise.
- Attackers can target administrative accounts to gain privileged access.
2. Privilege Escalation and Lateral Movement
- Attackers can pivot within a corporate network using pass-the-hash techniques, allowing them to escalate privileges without needing the actual password.
3. Network Compromise and Organizational Threats
- Affected companies face data exfiltration risks, unauthorized system modifications, and potential ransomware deployment following credential theft.
4. Multi-Stage Cyber Attacks
- Ransomware groups may leverage CVE-2025-24054 to gain initial access, followed by widespread system encryption to demand ransom payments.
Mitigation Strategies
1. Apply Microsoft’s Security Patch
- Update Windows to the latest security patch (March 11, 2025) to block unauthorized NTLM authentication requests.
2. Disable NTLM Authentication Over SMB
- Configure Group Policy to restrict NTLM authentication, preventing malicious servers from collecting NTLM hashes.
3. Implement Network Monitoring and Threat Detection
- Use Intrusion Detection Systems (IDS) or SIEM solutions to monitor SMB authentication traffic for anomalies.
- Track unusual outbound NTLM authentication attempts to unknown external IP addresses.
4. Enhance User Awareness and Phishing Protection
- Educate employees about malicious
.library-msfiles, warning them against interacting with unknown archive contents. - Enforce email security protocols such as attachment scanning and sandbox execution.
5. Enforce Strong Authentication Mechanisms
- Implement multi-factor authentication (MFA) to protect accounts even if an NTLM hash is stolen.
- Enforce Kerberos authentication instead of NTLM for securing internal authentication workflows.
Final Thoughts
CVE-2025-24054 is a dangerous NTLM authentication vulnerability that allows attackers to steal NTLMv2-SSP hashes silently, enabling pass-the-hash attacks and lateral movement within corporate networks. Organizations must apply security patches immediately, disable NTLM authentication where possible, and deploy threat monitoring tools to prevent exploitation.
