CVE-2024-30073: Windows 10 1507 Auth Bypass Vulnerability

CVE-2024-30073 Overview

CVE-2024-30073 is a security feature bypass vulnerability in the Windows Security Zone Mapping component. The flaw allows attackers to bypass zone-based trust decisions that Windows uses to distinguish Internet-sourced content from local or trusted content. Successful exploitation requires local access and user interaction, such as opening a crafted file. Microsoft has assigned a CVSS 3.1 base score of 7.8 to this issue, and it affects supported versions of Windows 10, Windows 11, and Windows Server. The vulnerability is categorized under [CWE-41] (Improper Resolution of Path Equivalence).

Critical Impact
Attackers can bypass Windows Security Zone protections to execute untrusted content with elevated trust, leading to full compromise of confidentiality, integrity, and availability on the affected host.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 21H2, 22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-09-10 - CVE-2024-30073 published to NVD as part of Microsoft's September 2024 Patch Tuesday
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2024-30073

Vulnerability Analysis

Windows Security Zone Mapping assigns content to trust zones (Internet, Intranet, Trusted, Restricted, Local Machine) that govern how the operating system and applications treat files, scripts, and URLs. The mapping influences Mark-of-the-Web (MOTW) enforcement, SmartScreen prompts, Office Protected View, and script execution policies. CVE-2024-30073 allows an attacker to manipulate how Windows resolves zone identifiers so that content originating from an untrusted zone is evaluated as if it belonged to a more privileged zone. This bypass removes the security prompts and execution restrictions users rely on when handling files delivered from the Internet. The vulnerability affects all supported branches of Windows client and server, indicating the flaw resides in shared zone-resolution logic rather than a version-specific component.

Root Cause

The root cause is improper resolution of path equivalence [CWE-41] within the zone mapping subsystem. Windows fails to correctly canonicalize identifiers used to determine the security zone of a resource. An attacker can construct paths or identifiers that evade the checks enforcing zone assignments, causing the operating system to treat Internet-sourced content as local or trusted.

Attack Vector

Exploitation requires local access and user interaction. An attacker crafts a file or archive containing content designed to trigger the zone-mapping bypass, then delivers it through phishing, a malicious website, or a removable device. When the user opens the payload, Windows applies incorrect zone protections, allowing scripts, macros, or executables to run without the warnings that normally block Internet-sourced code. Chained with a phishing lure or a browser download, the vulnerability becomes a practical initial access primitive.

No public proof-of-concept or exploit code is currently listed for this CVE. The vulnerability is not on the CISA Known Exploited Vulnerabilities catalog at the time of writing.

Detection Methods for CVE-2024-30073

Indicators of Compromise

Files downloaded from the Internet that are missing or have manipulated Zone.Identifier alternate data streams (MOTW tampering).
Execution of scripts (.js, .vbs, .hta, .ps1) or Office documents from user download directories without the expected SmartScreen or Protected View prompts.
Unusual child processes spawned by explorer.exe, winrar.exe, 7zg.exe, or archive utilities immediately after a user opens downloaded content.

Detection Strategies

Monitor process creation events (Sysmon Event ID 1, Windows Event ID 4688) for scripting hosts (wscript.exe, cscript.exe, mshta.exe, powershell.exe) launched from user-writable paths such as Downloads, Temp, or mounted archive locations.
Audit alternate data stream reads and writes on downloaded files to identify tampering with Zone.Identifier metadata.
Correlate browser or mail client file writes with subsequent execution events lacking a corresponding MOTW-triggered prompt.

Monitoring Recommendations

Enable and forward Sysmon file-creation and process-creation telemetry to a centralized SIEM for zone-related analytics.
Track Microsoft Defender SmartScreen and Windows Defender Application Control (WDAC) block events to identify anomalies in enforcement rates.
Alert on execution of interpreters and installer utilities from ZIP, ISO, IMG, or VHD mount paths, which are common containers used to strip MOTW.

How to Mitigate CVE-2024-30073

Immediate Actions Required

Apply the Microsoft security update for CVE-2024-30073 to all affected Windows client and server systems.
Prioritize patching on endpoints used for email, web browsing, and file handling where user interaction with untrusted content is most likely.
Verify that MOTW propagation is enabled and that archive utilities in use preserve zone identifiers on extraction.

Patch Information

Microsoft released fixes as part of the September 2024 security updates. Refer to the Microsoft Security Update Guide for CVE-2024-30073 for the exact KB articles and cumulative updates required for each supported Windows version.

Workarounds

Restrict execution of scripting engines from user download and temporary directories using AppLocker or Windows Defender Application Control policies.
Configure Microsoft Office to enforce Protected View and block macros in files originating from the Internet, independent of zone mapping.
Train users to treat downloaded archives, ISO, and IMG files as untrusted and to avoid opening embedded executables or scripts.

bash

# Example AppLocker rule concept to block scripting hosts from user download paths
# Deny: wscript.exe, cscript.exe, mshta.exe when launched from %USERPROFILE%\Downloads\*
# Enforce via Group Policy: Computer Configuration > Windows Settings >
#   Security Settings > Application Control Policies > AppLocker > Script Rules