CVE-2024-30040: Windows 10 1507 Auth Bypass Vulnerability

CVE-2024-30040 Overview

CVE-2024-30040 is a security feature bypass vulnerability affecting the Windows MSHTML Platform. This vulnerability allows attackers to circumvent OLE (Object Linking and Embedding) mitigations in Microsoft 365 and Microsoft Office, enabling the execution of arbitrary code in the context of the user. The MSHTML platform, also known as Trident, is the legacy browser engine used by Internet Explorer and remains integrated into Windows to support various application compatibility scenarios.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Successful exploitation allows attackers to bypass security mitigations and execute arbitrary code when a user interacts with a malicious document.

Affected Products

• Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Windows Server 2022
• Microsoft Windows Server 2022 23H2

Discovery Timeline

• May 14, 2024 - CVE-2024-30040 published to NVD
• October 28, 2025 - Last updated in NVD database

Technical Details for CVE-2024-30040

Vulnerability Analysis

The Windows MSHTML Platform Security Feature Bypass vulnerability stems from improper input validation (CWE-20) within the MSHTML rendering engine. This flaw allows attackers to bypass OLE mitigations that Microsoft has implemented in Microsoft 365 and Microsoft Office applications to protect users from malicious embedded objects.

When exploited, this vulnerability circumvents security controls designed to prevent the automatic execution of potentially dangerous content within Office documents. The MSHTML platform processes various content types, and the bypass allows malicious actors to evade protections that would normally block or warn users about risky embedded content.

The attack requires user interaction—specifically, the victim must open or preview a specially crafted document. However, once this interaction occurs, the attacker can achieve code execution in the security context of the current user, potentially leading to full system compromise if the user has elevated privileges.

Root Cause

The vulnerability originates from improper input validation within the MSHTML platform's handling of OLE objects. The security feature designed to mitigate risks from embedded objects fails to properly validate certain malicious constructs, allowing attackers to craft documents that evade these protections entirely.

Attack Vector

The attack is delivered over the network and requires user interaction. Threat actors typically deliver malicious documents via email attachments or compromised websites. When a user opens or previews the specially crafted document, the malicious payload executes, bypassing the OLE mitigations that should have prevented such execution.

The exploitation flow generally follows this pattern:

1. Attacker creates a malicious document containing specially crafted content designed to bypass OLE mitigations
2. The document is delivered to the victim via phishing email or other social engineering techniques
3. When the victim opens or previews the document, the MSHTML platform processes the content
4. The security feature bypass allows the embedded malicious code to execute
5. The attacker achieves code execution in the context of the current user

Detection Methods for CVE-2024-30040

Indicators of Compromise

• Suspicious Office documents (.docx, .xlsx, .rtf, .doc) received via email from unknown senders
• Unusual child processes spawning from Microsoft Office applications (e.g., winword.exe, excel.exe)
• Network connections initiated by Office applications to unknown external IP addresses
• Presence of suspicious OLE objects or embedded content within Office documents

Detection Strategies

• Monitor process creation events for Office applications spawning unexpected child processes such as cmd.exe, powershell.exe, or mshta.exe
• Implement email gateway filtering to scan attachments for malicious embedded objects
• Deploy endpoint detection and response (EDR) solutions like SentinelOne to detect and block exploitation attempts in real-time
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block Office applications from creating executable content

Monitoring Recommendations

• Configure SIEM alerts for anomalous Office application behavior, particularly unusual network activity or process spawning
• Review Windows Event Logs for events related to OLE object instantiation and MSHTML component loading
• Monitor for suspicious document file creation in temporary directories and user profile locations
• Implement behavioral analysis to detect post-exploitation activities following document execution

How to Mitigate CVE-2024-30040

Immediate Actions Required

• Apply Microsoft's May 2024 security updates immediately to all affected Windows systems
• Prioritize patching for systems where users regularly interact with Office documents from external sources
• Enable Microsoft Defender Antivirus with cloud-delivered protection for additional detection capabilities
• Review and restrict user permissions to minimize the impact of potential exploitation

Patch Information

Microsoft has released security updates addressing this vulnerability as part of the May 2024 Patch Tuesday release. Organizations should apply the appropriate cumulative updates for their Windows versions. Detailed patch information and download links are available through the Microsoft Security Update Guide.

Given the active exploitation status and inclusion in the CISA Known Exploited Vulnerabilities Catalog, federal agencies are required to remediate this vulnerability according to CISA's binding operational directives.

Workarounds

• Configure Office applications to open documents from the internet in Protected View and block embedded objects
• Implement application whitelisting to prevent unauthorized code execution
• Disable OLE object embedding in Office Group Policy settings where business requirements permit
• Educate users about the risks of opening documents from untrusted sources

# Windows Defender ASR Rule to block Office applications from creating child processes
# Run in elevated PowerShell
Add-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions Enabled

# Enable Protected View for files from the internet via registry
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f