CVE-2024-43573: Windows 10 1507 MSHTML XSS Vulnerability

CVE-2024-43573 Overview

CVE-2024-43573 is a spoofing vulnerability in the Windows MSHTML platform, the legacy HTML rendering engine still embedded in modern Windows releases. Microsoft disclosed the flaw on October 8, 2024, and CISA added it to the Known Exploited Vulnerabilities (KEV) Catalog after observing active exploitation. The vulnerability affects supported Windows 10, Windows 11, and Windows Server releases. Attackers exploit it by tricking users into opening crafted content, enabling spoofed interface elements that mask malicious activity.

Critical Impact

Successful exploitation allows attackers to spoof the rendering of web or document content in MSHTML, facilitating phishing, credential theft, and follow-on code execution chains. The flaw is confirmed exploited in the wild and listed in the CISA KEV Catalog.

Affected Products

• Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (21H2, 22H2, 23H2, 24H2)
• Microsoft Windows Server 2012 R2, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

• 2024-10-08 - Microsoft publishes advisory and security patch on Patch Tuesday
• 2024-10-08 - CVE-2024-43573 published to NVD
• 2025-10-30 - Last updated in NVD database

Technical Details for CVE-2024-43573

Vulnerability Analysis

The vulnerability resides in the MSHTML platform, the Trident rendering engine historically used by Internet Explorer and still reachable through Windows components, Office document previews, and applications that embed the WebBrowser control. MSHTML continues to parse HTML, CSS, and script content even on systems where the Internet Explorer browser shell has been retired.

Microsoft categorizes the flaw as spoofing, mapped to [CWE-79] (Improper Neutralization of Input During Web Page Generation). The bug enables an attacker to render content in a way that misleads the user about its origin, contents, or trust level. Industry analysis has linked the issue to the same class of MSHTML weaknesses abused by threat actors using crafted Internet Shortcut and HTA-style files to bypass Mark-of-the-Web protections.

Because MSHTML is invoked by multiple Windows components, exploitation does not require an active Internet Explorer installation. The CISA KEV listing confirms in-the-wild use against unpatched endpoints.

Root Cause

The root cause is improper neutralization of attacker-controlled content during HTML generation inside the MSHTML platform. Crafted markup is rendered without adequate sanitization, allowing the displayed content to misrepresent its true source or behavior. This breaks the security boundary users rely on to identify malicious documents and links.

Attack Vector

The attack vector is network-based but requires user interaction. An attacker delivers a crafted file or URL through phishing email, instant messaging, or a malicious website. When the victim opens the lure, MSHTML processes the content and produces a spoofed presentation that obscures the malicious payload, often used as the first stage in multi-step intrusion chains.

No public proof-of-concept code is referenced in NVD for this CVE. See the Microsoft CVE-2024-43573 Update Guide and the CISA Known Exploited Vulnerability Catalog for vendor-confirmed details.

Detection Methods for CVE-2024-43573

Indicators of Compromise

• Unexpected execution of mshtml.dll invoked by non-browser host processes such as explorer.exe, wscript.exe, or Office applications.
• Internet Shortcut (.url), HTML Application (.hta), or .chm files arriving via email attachments and opening to render remote content.
• Outbound connections to attacker-controlled hosts immediately after a user opens a document or shortcut file.
• Files written to disk without Mark-of-the-Web markers despite originating from internet downloads.

Detection Strategies

• Hunt for child process creation chains where Office, Outlook, or Explorer spawn mshta.exe, rundll32.exe, or PowerShell after opening shortcut and HTML files.
• Alert on mshtml.dll loads in unusual process contexts and correlate with recent file delivery events.
• Inspect email gateways for .url and .hta attachments and for HTML files containing obfuscated script tags.

Monitoring Recommendations

• Forward Windows process, image-load, and file-creation telemetry to a centralized analytics platform for correlation.
• Monitor endpoints for Mark-of-the-Web tampering and suspicious zone identifier changes on downloaded files.
• Track patch state across Windows 10, Windows 11, and Windows Server fleets to surface hosts still missing the October 2024 cumulative update.

How to Mitigate CVE-2024-43573

Immediate Actions Required

• Apply the October 2024 Microsoft cumulative security updates to all affected Windows 10, Windows 11, and Windows Server systems immediately, prioritizing internet-facing and user-facing endpoints.
• Treat this CVE as a priority remediation item due to its presence on the CISA KEV Catalog and federal binding directive timelines.
• Block delivery of .url, .hta, .chm, and similar high-risk file types at email and web gateways where business needs allow.

Patch Information

Microsoft released fixes through the October 8, 2024 Patch Tuesday cumulative updates. Refer to the Microsoft CVE-2024-43573 Update Guide for the specific KB articles corresponding to each Windows build. Ensure servicing stack updates are current before installing the cumulative package.

Workarounds

• Enforce Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from launching downloaded executable content.
• Configure Microsoft Defender SmartScreen and Mark-of-the-Web enforcement to flag files originating from the internet.
• Restrict execution of mshta.exe through Windows Defender Application Control or AppLocker policies on systems that do not require it.

# Example: Enable ASR rule blocking Office child process creation (Block mode)
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Example: Restrict mshta.exe execution via AppLocker (deny rule snippet)
New-AppLockerPolicy -RuleType Path -User Everyone `
                    -Path "%SYSTEM32%\mshta.exe" -Action Deny