A security researcher, Nafiez, has unveiled a previously undiscovered vulnerability in Windows LNK files (shortcuts) that could enable attackers to execute malicious code remotely without any user interaction. Although a proof-of-concept (PoC) has been made publicly available, Microsoft has decided not to release a patch for the issue, claiming that it does not meet the necessary security criteria for fixing.
The flaw exploits specific aspects of the Windows shortcut file structure, allowing attackers to craft malicious LNK files. These files contain altered EnvironmentVariableDataBlock and UNC paths that can silently trigger network connections when a user opens a folder containing the malicious shortcut, even without clicking on it.
According to Nafiez’s technical breakdown, when a user accesses a folder with an infected LNK file, Windows Explorer automatically processes the file, preparing it for execution without any direct action by the user. The risk is particularly significant because just browsing a folder with the malicious file is enough to initiate the exploit.
PoC Overview
The exploit manipulates several critical elements of the LNK file’s architecture, including:
- Adjusting the HasArguments flag and EnvironmentVariableDataBlock to control how the file behaves
- Embedding a UNC path (e.g., \192.168.44.128\c) to target a network resource
- Specifying BlockSize and signature values to dictate the file’s behavior
Windows Explorer processes these specially crafted LNK files using various COM interfaces, such as IInitializeNetworkFolder and IShellFolder2, that handle network resources. This process starts automatically when a user accesses the folder, allowing for the silent execution of malicious code.
Microsoft has defended its decision not to address this vulnerability, pointing to the Mark of the Web (MOTW) security feature, which is designed to flag potentially dangerous files downloaded from the internet and issue security warnings before execution.
This stance reflects Microsoft’s typical approach to similar LNK vulnerabilities. Their policy dictates that they will only release patches for issues that directly compromise a security boundary or feature, provided they meet the severity requirements for servicing.
As Nafiez explained in his technical analysis, “Once you compile the code, execute the program to generate the LNK file, and use the Responder tool to capture the NTLM Hash.”
Cybersecurity professionals are raising alarms that relying exclusively on the Mark of the Web (MOTW) security feature may not be enough to safeguard against threats, as attackers have developed techniques to bypass this protection. Recently, researchers at Elastic Security Labs identified a method called “LNK stomping,” a tactic that has been exploited by threat actors for over six years to circumvent MOTW defenses.
This isn’t the first time LNK files have been used as an attack vector. Microsoft has previously patched significant vulnerabilities in LNK files, such as a critical remote code execution flaw in 2017 and another major exploit in 2010 that was actively targeted.
LNK files, often seen as innocuous Windows shortcuts, have become increasingly favored by cybercriminals. As researchers from Intezer point out, “LNK files may appear simple, but they offer attackers a pathway to execute malicious binaries and cause significant damage.”
The release of the proof-of-concept code for this vulnerability further fuels concerns that it could soon be leveraged by cybercriminals in real-world attacks.
