Advisory 73: Microsoft Windows MSHTML Platform Spoofing Vulnerability
Release Date: 14th of September 2024
Impact : HIGH / CRITICAL
TLP Rating: Clear 
CERT Vanuatu (CERTVU) and the Office of the Chief Information Officer (OGCIO) provide the following advisory.
What is it?
The Windows MSHTML Platform Spoofing Vulnerability refers to a security flaw within the MSHTML (Trident) engine, which is used by Internet Explorer and other applications that rely on web content rendering. The vulnerability allows attackers to craft a malicious web page or document that misrepresents or "spoofs" content, tricking the user into interacting with it under false pretenses.
What are the Systems affected?
- Microsoft Windows 11 Version 24H2 – 32-bit, x64-Based System, ARM64-based System
- Microsoft Windows 10 Version 1809 – 32-bit, x64-Based System, ARM64-based System
- Microsoft Windows Server 2019 – x64-Based System
- Microsoft Windows Server 2019 (Server Core Installation) – x64-Based System
- Microsoft Windows Server 2022 – x64-Based System
- Microsoft Windows 11 Version 21H2 – x64-Based System, ARM64-based System
- Microsoft Windows 10 Version 21H2 – 32-bit System and x64-Based System
- Microsoft Windows 11 Version 22H2 – x64-Based System, ARM64-based System
- Microsoft Windows 10 Version 22H2 – x64-Based System, ARM64-based System
- Microsoft Windows 11 Version 22H3 – x64-Based System, ARM64-based System
- Microsoft Windows 11 Version 23H2 – x64-Based System, ARM64-based System
- Microsoft Windows Server 2022, 23H2 Edition (Server Core Installation) – x64-Based System
- Microsoft Windows 11 Version 24H2 – x64-Based System, ARM64-based System
- Microsoft Windows 10 Version 1507 – x64-Based System, ARM64-based System
- Microsoft Windows 10 Version 1607 – x64-Based System, ARM64-based System
- Microsoft Windows Server 2016 – x64-Based System
- Microsoft Windows Server 2016 (Server Core Installation) – x64-Based System
- Microsoft Windows Server 2012 – x64-Based System
- Microsoft Windows Server 2012 (Server Core Installation) – x64-Based System
- Microsoft Windows Server 2012 R2 – x64-Based System
- Microsoft Windows Server 2012 R2 (Server Core Installation) – x64-Based System
What this means?
If Vulnerabilities are not addressed, a cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. The vulnerability allows attackers to craft a malicious web page or document that misrepresents or "spoofs" content, tricking the user into interacting with it under false pretenses.
Mitigation process
CERTVU Encourages users and administrators to review the below and apply necessary security updates.
References
- https://www.cisa.gov/news-events/alerts/2024/09/10/cisa-adds-four-known-exploited-vulnerabilities-catalog
- https://www.cve.org/CVERecord?id=CVE-2024-38217
- Download advisory (English): Microsoft Windows MSHTML Platform Spoofing Vulnerability
- Download advisory (Bislama): Vulnerabiliti long saed blong MSHTML Platform Spoofing blong Microsoft Windows
- Download advisory (French): Vulnérabilité d’usurpation de l’identité dans la plateforme Microsoft Windows MSHTML