High‑Severity NTLMv2 Hash Disclosure Spoofing Vulnerability in Microsoft Windows (CVE‑2024‑43451)
What It Is
Microsoft Windows implements NTLMv2 for legacy authentication. A flaw in the handling of file‑open operations can cause the system to disclose a user’s NTLMv2 hash to an attacker. Possession of that hash enables the attacker to impersonate the user in subsequent authentication attempts.
Exploitability
- Active exploitation: Not publicly reported, but the vulnerability is classified as High severity and a proof‑of‑concept exists in the public domain.
- CVSS: Assigned a high base score (≥7.0) by NVD.
- Attack vector: Requires the ability to trigger a file‑open request (e.g., via SMB or a local application).
Affected Products
- Microsoft Windows (all supported editions that retain NTLMv2 authentication).
Why It Matters for Compliance & Audit Readiness
- Access‑Control Assurance: NTLM hash leakage undermines the integrity of identity‑based controls, a core requirement of frameworks such as NIST 800‑53 AC‑2 and ISO 27001 A.9.
- Continuous Control Monitoring: Detecting anomalous NTLM authentication events provides evidence of due diligence and supports a defensible audit trail.
- Vendor‑Management Controls: The vulnerability highlights the need for a formal patch‑management process and verification that legacy protocols are either hardened or disabled.
Recommended Actions
- Patch Immediately: Apply Microsoft’s security update that addresses CVE‑2024‑43451.
- Disable NTLM Where Possible: Transition to Kerberos or modern authentication mechanisms; enforce “Deny NTLM” policies via Group Policy.
- Monitor Authentication Logs: Enable detailed NTLM event logging and set up alerts for unexpected hash‑related activity.
- Update Control Mapping: Document the NTLM protocol as a high‑risk control in your Trust Center; map remediation steps to the relevant access‑control controls.
- Capture Evidence: Archive patch‑deployment records and log‑analysis reports to demonstrate compliance during audits.
Source: CISA KEV – CVE‑2024‑43451