Introduction

On September 30, 2024, Microsoft released security update KB5046418 to address significant vulnerabilities associated with HTML Application (.hta) files in Internet Explorer and Internet Explorer mode within Microsoft Edge. This update is a proactive measure to enhance user security by modifying how these files are handled during downloads.

Understanding HTA Files and Associated Risks

HTML Application (HTA) files are executable files that combine HTML and scripting code, allowing developers to create applications with the full capabilities of the Windows environment. While HTA files offer flexibility, they also pose security risks. Malicious actors can craft HTA files to execute harmful code, leading to data breaches or system compromises. The risk is heightened when users open these files directly from the browser's download dialog, potentially bypassing security prompts.

Key Changes Implemented in KB5046418

With the KB5046418 update, Microsoft has removed the option to open .hta files directly from the download dialog in Internet Explorer and its mode in Microsoft Edge. Users are now required to save these files to their local system before opening them. This change, effective from updates released on or after September 10, 2024, aims to provide an additional layer of security by encouraging users to verify the safety of HTA files before execution.

Technical Details and Vulnerability Exploitation

The update addresses vulnerabilities identified as CVE-2024-43461 and CVE-2024-38112. These flaws were exploited by threat actors to deliver malware through deceptive HTA files. Specifically:

  • CVE-2024-38112: Allowed attackers to manipulate Windows into opening malicious websites in Internet Explorer instead of the default browser, facilitating the download of harmful HTA files.
  • CVE-2024-43461: Enabled the disguise of HTA files as harmless documents by obscuring their true file extensions, increasing the likelihood of user execution.

These vulnerabilities were actively exploited by the Void Banshee APT group to distribute the Atlantida info-stealer malware, which targets sensitive user data, including credentials and cryptocurrency wallets.

Implications and Impact

The exploitation of these vulnerabilities underscores the importance of robust security practices. By modifying the handling of HTA files, Microsoft aims to reduce the attack surface available to malicious actors. Users are encouraged to:

  • Exercise Caution: Avoid opening HTA files from untrusted sources.
  • Verify File Integrity: Before executing downloaded files, ensure they are from reputable sources and have been scanned for malware.
  • Keep Systems Updated: Regularly apply security updates to protect against known vulnerabilities.

Conclusion

Microsoft's KB5046418 update is a critical step in mitigating risks associated with HTA files. By altering how these files are handled during downloads, the update enhances user security and reduces the potential for malicious exploitation. Users are advised to apply this update promptly and adhere to best practices for handling executable files.