Microsoft Windows XP Folder Automatic Execution Vulnerability

vendor:

Windows XP

by:

Not mentioned

7.5

CVSS

HIGH

Folder Automatic Execution

CWE

Product Name: Windows XP

Affected Version From: Microsoft Windows XP

Affected Version To: Unknown

Patch Exists: NO

Related CWE: Not mentioned

CPE: o:microsoft:windows_xp

Metasploit:

Other Scripts:

Platforms Tested: Windows XP

Unknown

Microsoft Windows XP Folder Automatic Execution Vulnerability

A vulnerability in Windows Explorer allows for the automatic execution of executable content when a folder is accessed. This can be exploited by malicious actors to run code in the context of the logged-in user. Opening a folder is typically considered safe, making this vulnerability particularly dangerous. The issue can also be exploited remotely if the malicious folder is accessed from an SMB share. A proof-of-concept exploit has been provided that demonstrates the execution of NetMeeting and installation of a keylogger on a vulnerable system.

Mitigation:

No specific mitigation steps provided.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/10363/info

A vulnerability has been reported in Microsoft Windows XP that may cause malicious code to run in the context of the currently logged-in user. The flaw exists in Windows Explorer and may allow executable content that is referenced from inside a folder to run automatically when the folder is accessed. 

This vulnerability poses a security risk since users assume that opening a folder is a safe action and that executable content cannot be run when a folder is accessed. Additionally, attackers may be able to exploit this issue remotely if the malicious folder is accessed from an SMB share. 

The reporter of this issue has provided a proof-of-concept exploit that executes NetMeeting and installs a keylogger on a vulnerable system.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24125.zip