CVE-2024-43461: Windows MSHTML Platform Spoofing Flaw

CVE-2024-43461 Overview

CVE-2024-43461 is a spoofing vulnerability in the Windows MSHTML platform that affects all supported versions of Windows 10, Windows 11, and Windows Server. The flaw enables attackers to disguise malicious files using crafted filenames containing embedded braille whitespace characters, hiding the true file extension from users. Successful exploitation requires user interaction, typically opening a malicious file delivered through phishing or a malicious website. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog after confirming in-the-wild abuse by threat actors, including the Void Banshee APT group, who used it to deliver the Atlantida infostealer. The vulnerability is classified under [CWE-451] (User Interface Misrepresentation of Critical Information).

Critical Impact
Attackers can spoof file extensions to trick users into executing malicious HTA payloads, leading to full compromise of confidentiality, integrity, and availability on targeted systems.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 21H2, 22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-09-10 - CVE-2024-43461 published to NVD and addressed in Microsoft September 2024 Patch Tuesday
2025-10-28 - Last updated in NVD database

Technical Details for CVE-2024-43461

Vulnerability Analysis

The vulnerability resides in the Windows MSHTML platform, the legacy rendering engine still invoked by Internet Explorer mode and HTML Application (HTA) handlers. Attackers craft filenames that contain a long sequence of braille pattern blank characters (U+2800) between a benign-looking extension and the true .hta extension. When Windows displays the filename in dialogs and warning prompts, the visible portion shows what appears to be a PDF or other harmless document, while the actual extension remains hidden by the whitespace padding.

The vulnerability has been weaponized in active intrusion campaigns. Threat actors deliver weaponized URL files that, when opened, fetch an HTA payload through MSHTML. The spoofed filename presented to the victim bypasses the visual cues users rely on to identify executable content. Successful execution leads to deployment of infostealer malware that harvests credentials, browser data, and cryptocurrency wallets.

Root Cause

The root cause is improper handling of Unicode braille whitespace characters (U+2800) in filename rendering within MSHTML and File Explorer dialogs. Windows truncates or visually conceals the trailing portion of long filenames without sanitizing or normalizing deceptive Unicode padding. This results in user interface misrepresentation, allowing the real file type to remain hidden from the user at decision time.

Attack Vector

The attack vector is network-based with required user interaction. Attackers deliver a crafted file, typically through phishing email attachments, malicious websites, or compromised file shares. The file is named with a deceptive extension followed by braille blank padding and the true .hta extension. When the user double-clicks the file, the MSHTML-hosted HTA executes attacker-controlled script with the privileges of the current user.

No verified proof-of-concept code is included here. Public analysis of the in-the-wild exploitation chain has been published by Trend Micro's Zero Day Initiative and Check Point Research; refer to those sources for technical details on the Void Banshee campaign.

Detection Methods for CVE-2024-43461

Indicators of Compromise

Files with names containing repeated U+2800 (braille pattern blank) characters, particularly preceding .hta, .url, or .cpl extensions
Unexpected mshta.exe child processes spawned from Explorer, browsers, or email clients
Network connections from mshta.exe to external domains hosting payload scripts
Presence of .url files referencing remote HTA resources via URL= directives

Detection Strategies

Hunt for process creation events where mshta.exe is launched with arguments containing URLs or unusual file paths
Scan file systems and email gateways for filenames containing Unicode U+2800 sequences
Alert on .url shortcut files that resolve to HTA payloads hosted on uncategorized or newly registered domains
Correlate user file-open events with subsequent script interpreter execution and outbound network activity

Monitoring Recommendations

Log all mshta.exe executions across the environment and forward to centralized analytics
Monitor Windows Defender SmartScreen and Mark-of-the-Web (MOTW) bypass events
Track downloads of .url and .hta files from email and web proxies
Inspect filename Unicode codepoints during email attachment and download scanning

How to Mitigate CVE-2024-43461

Immediate Actions Required

Apply Microsoft's September 2024 security updates to all affected Windows endpoints and servers without delay
Prioritize systems exposed to email and web traffic, including user workstations and remote access hosts
Hunt retroactively for signs of exploitation, particularly Void Banshee and Atlantida stealer indicators
Reset credentials on any endpoint where exploitation is suspected, given the infostealer payload

Patch Information

Microsoft released patches addressing CVE-2024-43461 on September 10, 2024, as part of the monthly Patch Tuesday cycle. The fix is available through Windows Update and the Microsoft Update Catalog. Refer to the Microsoft Security Response Center advisory for the complete KB list mapped to each Windows version. CISA's Known Exploited Vulnerabilities entry sets federal remediation deadlines.

Workarounds

Block execution of .hta files via Group Policy, AppLocker, or Windows Defender Application Control
Reassociate the .hta file handler from mshta.exe to a benign application such as Notepad
Filter email attachments and web downloads containing Unicode U+2800 characters in filenames
Restrict outbound network access from mshta.exe at the host firewall or EDR policy layer

bash

# Disable mshta.exe execution via AppLocker rule (PowerShell)
New-AppLockerPolicy -RuleType Path -User Everyone -Path "%SystemRoot%\System32\mshta.exe" -Action Deny

# Reassociate .hta extension to Notepad
ftype htafile="%SystemRoot%\System32\notepad.exe" "%1"
assoc .hta=htafile