CVE-2024-30040

What it actually does

CVE-2024-30040 is a Windows MSHTML security feature bypass affecting supported Windows client and server releases. MSHTML, the legacy HTML rendering engine still used by Windows and some applications, can be abused through specially crafted content to bypass intended protections around untrusted web or document content. Exploitation requires user interaction, typically opening or previewing attacker-supplied content, but does not require attacker authentication. In a successful attack, the bypass can allow attacker-controlled active content to execute in a less restricted context and can be used as part of a chain to run code, steal data, or install follow-on malware with the privileges of the user who opened the content.

Why it matters to the business

This vulnerability has confirmed in-the-wild exploitation and is listed in CISA KEV, with a federal remediation due date of 2024-06-04, making it a high-priority patching item even though user interaction is required. Organizations with Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, or Windows Server 2022 systems exposed to email, web browsing, document handling, or shared-file workflows are at risk of phishing-driven compromise. A successful attack can lead to workstation takeover, credential theft, lateral movement, data exposure, malware deployment, and operational disruption.

How an attack unfolds

An attacker prepares malicious web or document-based content that triggers the MSHTML platform flaw. The content is delivered through a phishing email, malicious attachment, embedded link, compromised website, file share, or collaboration platform. The attacker then convinces a user to open or preview the content. When Windows or an application invokes MSHTML to render or process the content, the crafted input bypasses expected security controls for untrusted content. The attacker uses that bypass to launch script, invoke Windows living-off-the-land binaries, retrieve a second-stage payload, or chain with another vulnerability for full code execution. Post-exploitation commonly involves command execution, persistence setup, credential access, payload download, and internal reconnaissance.

How to fix it

Apply the Microsoft security updates released on or after 2024-05-14 for all affected Windows versions, including Windows 10 1507/1607/1809/21H2/22H2, Windows 11 21H2/22H2/23H2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2022 23H2. Because no standalone fixed application version is provided, remediation is through the applicable Windows cumulative update or security-only update for the operating system. Prioritize internet-facing, user-facing, VDI, helpdesk, email-processing, file-processing, and administrative workstations. Where immediate patching is not possible, reduce exposure by hardening email and web filtering, blocking or isolating high-risk attachments, disabling unnecessary legacy script handlers, restricting child-process creation from Office and browsers, enforcing Attack Surface Reduction rules, and ensuring users do not operate with local administrator privileges.

How to confirm the fix worked

Confirm each affected endpoint and server has installed the applicable May 2024 or later Windows cumulative/security update. Validate through centralized patch management, Windows Update history, vulnerability scanning, or authenticated inventory checks. Confirm the MSHTML component files, especially mshtml.dll, are at OS build levels corresponding to the May 2024 security baseline or later. Test that endpoint controls alert on or block suspicious child processes from Office, Outlook, browsers, and HTML/script handlers. Re-scan assets after patch deployment and verify unsupported or end-of-life Windows builds are either upgraded, isolated, or removed from production use.

Typical attack path

1. Identify users or systems likely to open web links, Office documents, shortcut files, HTML content, or other files that may invoke MSHTML.
2. Create malicious content designed to trigger the MSHTML security feature bypass.
3. Deliver the content through phishing, malicious links, compromised websites, file shares, or collaboration tools.
4. Convince the target user to open or preview the content.
5. MSHTML processes the crafted content and bypasses intended security restrictions.
6. The attacker launches script or a child process such as mshta.exe, rundll32.exe, regsvr32.exe, powershell.exe, wscript.exe, cscript.exe, or cmd.exe.
7. A second-stage payload is downloaded or executed under the user’s privileges.
8. The attacker performs credential theft, persistence, reconnaissance, lateral movement, or additional exploitation.

How to detect it

To determine whether exploitation has already occurred, review endpoint, email, web proxy, DNS, and EDR telemetry for user-opened HTML, Office, shortcut, or web archive content followed by unusual process creation or outbound network activity. Focus on sequences where outlook.exe, winword.exe, excel.exe, powerpnt.exe, explorer.exe, browser processes, preview handlers, or applications loading mshtml.dll spawn scripting or command execution tools. Relevant Windows telemetry includes Security Event ID 4688 for process creation, Sysmon Event ID 1 for process creation, Sysmon Event ID 3 for network connections, Sysmon Event ID 7 for image loads involving mshtml.dll, Sysmon Event ID 11 for dropped files, PowerShell Operational logs, Defender for Endpoint device process events, email gateway attachment and URL detonation logs, proxy logs, and DNS resolver logs. Look for documents or HTML content launched from Downloads, Temp, browser cache, Outlook cache, compressed archives, or network shares, followed by child processes such as mshta.exe, powershell.exe, wscript.exe, cscript.exe, regsvr32.exe, rundll32.exe, or cmd.exe. Investigate any payload downloads, encoded PowerShell, suspicious DLL registration, creation of persistence entries, new scheduled tasks, startup-folder files, or credential theft tooling after the initial user interaction. Because this CVE is a bypass rather than a malware family, absence of a single signature does not prove absence of exploitation; rely on behavioral correlation around MSHTML invocation, suspicious child processes, and post-exploitation activity.

• mshtml.dll
• mshta.exe
• wscript.exe
• cscript.exe
• rundll32.exe javascript:
• rundll32.exe url.dll,FileProtocolHandler
• regsvr32.exe /i:http
• powershell.exe -EncodedCommand
• powershell.exe -enc
• cmd.exe /c mshta
• mhtml:
• res://mshtml.dll
• outlook.exe -> mshta.exe
• winword.exe -> mshta.exe
• excel.exe -> mshta.exe
• powerpnt.exe -> mshta.exe
• outlook.exe -> powershell.exe
• winword.exe -> powershell.exe
• excel.exe -> powershell.exe
• powerpnt.exe -> powershell.exe
• outlook.exe -> rundll32.exe
• winword.exe -> rundll32.exe
• excel.exe -> rundll32.exe
• powerpnt.exe -> rundll32.exe
• \AppData\Local\Microsoft\Windows\INetCache\
• \AppData\Local\Temp\
• \AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
• Security Event ID 4688
• Sysmon Event ID 1
• Sysmon Event ID 3
• Sysmon Event ID 7
• Sysmon Event ID 11

What your security team should do

• Patch all affected Windows client and server systems immediately; treat this as urgent because it is in CISA KEV and has confirmed active exploitation.
• Prioritize systems used for email, web browsing, document review, file intake, administration, and privileged access.
• Hunt for suspicious Office, Outlook, browser, or file-preview activity that loads MSHTML and then spawns script interpreters, command shells, or download utilities.
• Enable or tighten Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and executable content.
• Block or quarantine high-risk inbound file types and content that can invoke MSHTML, active scripting, shortcut behavior, or external resource loading.
• Monitor for mshta.exe, rundll32.exe, regsvr32.exe, powershell.exe, wscript.exe, cscript.exe, or cmd.exe launched from user document, email, browser cache, or temporary directories.
• Review proxy, DNS, EDR, and email telemetry for suspicious links or attachments opened shortly before endpoint alerts.
• Ensure users do not have unnecessary local administrator rights to limit impact if exploitation succeeds.
• If suspicious activity is found, isolate affected hosts, collect forensic images or triage artifacts, rotate exposed credentials, and investigate lateral movement.
• Track patch compliance against the 2024-06-04 KEV due date or equivalent internal SLA.