Microsoft Windows Core Shell Spoofing Vulnerability

A vulnerability in Windows Core Shell allows unauthorized attackers to perform spoofing over a network by externally controlling file names or paths. This issue affects multiple Windows versions, including Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022. The vulnerability arises from the handling of file names and paths, which can be manipulated to deceive users or systems.

Impact

Exploitation of this vulnerability could lead to unauthorized spoofing, allowing attackers to impersonate or mislead users or systems over the network.

Reproduction

Exploitation of this vulnerability requires user interaction, such as opening the parent folder in File Explorer, clicking on the file, dragging the file, or deleting the file. These actions can trigger the leakage of the NTLM hash, which is a part of the authentication process in Windows.

Remediation

Users can apply the security update provided by Microsoft to address this vulnerability. This security update is available through the Microsoft Update Catalog.