CVE-2025-24054: NTLM Hash Disclosure and Coerced Authentication in Windows (.library-ms)

HERMES

HERMES THREAT SCORE & FORCED AUTHENTICATION IDENTITY THEFT

Target: Microsoft Windows Shell (.library-ms / .search-ms)

Confidence: 99%

84 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 18 / 20

Weaponization 19 / 20

Exposure 18 / 20

Prevalence 20 / 20

Impact 16 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

Hermes evaluates CVE-2025-24054 at an HTS of 84 (HIGH). Although rated CVSS 6.5 (Medium) due to user interaction scoping, this flaw triggers automated NetNTLMv2 hash harvesting upon folder browsing, directly enabling devastating NTLM relay attacks against Active Directory services.

🕸️ Connected Knowledge Graph & Provenance

CVE-2025-24054: NTLM Hash Disclosure and Coerced Authentication in Windows (.library-ms)VULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Windows & Windows Server

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Windows & Windows Server documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

1. Identification

Parameter	Technical Specification	Operational Impact
CVE Identifier	`CVE-2025-24054`	Microsoft March 2025 Security Update
Associated CWE	`CWE-73`: External Control of File Name or Path	Insecure handling of remote UNC paths in Shell
CVSS v3.1 Score	6.5 MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N`
CVSS v4.0 Score	6.9 MEDIUM	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`
Applicable CPEs	`cpe:2.3:o:microsoft:windows_10::::::::` `cpe:2.3:o:microsoft:windows_11::::::::` `cpe:2.3:o:microsoft:windows_server_2019::::::::` `cpe:2.3:o:microsoft:windows_server_2022::::::::`	All Windows client and server operating systems
Fixed Versions	March 2025 Patch Tuesday (KB5035853, etc.)	Enforces strict validation on remote library paths

2. Exploitation

CISA KEV: Added on April 17, 2025; active in-the-wild campaigns confirmed.
EPSS Score: 0.58909 (Percentile: 99.05% — exceptionally elevated exploitation probability).
Public PoC: Freely available offensive tools and proof-of-concept scripts (EDB-ID: 52478, 52480).
Attack Mechanics: A crafted .library-ms or .search-ms file specifies an external UNC share (\\attacker-ip\share). When a user views the directory in Windows Explorer, the shell automatically transmits the logged-in user’s NetNTLMv2 authentication challenge-response without prompt.

3. Detection and Forensics

Sigma Rule

title: Malicious Library-MS File Creation and Coerced NTLM Auth (CVE-2025-24054)
id: 24054-library-ms-coerced-auth-en
status: production
description: Detects the creation of .library-ms and .search-ms files commonly used in forced authentication attacks.
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '.library-ms'
      - '.search-ms'
  condition: selection
level: medium

MITRE ATT&CK

T1187: Forced Authentication
T1557.001: Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
T1110: Brute Force: Password Cracking

4. Remediation and Hardening

Apply Security Updates: Deploy the March 2025 Windows security updates across all endpoints.
Reboot Recommended: Restart endpoints to ensure all shell DLLs update in active sessions.
Block Outbound SMB: Block outbound TCP port 445 traffic at the perimeter network firewall to eliminate external NTLM credential leaks.
Enforce SMB Signing & EPA: Enforce SMB signing and Extended Protection for Authentication (EPA) across all internal Active Directory services to defeat relay attacks.

5. Enterprise Exploitation Scenario

« What happens if this vulnerability is exploited in an enterprise? »
Section titled “« What happens if this vulnerability is exploited in an enterprise? »”

Lure Placement: An adversary places a poisoned .library-ms file on an accessible internal network share.

Silent Coerced Authentication: A system administrator opens the folder in Windows Explorer. The system silently initiates an SMB handshake to the adversary’s listener.

Hash Relay: Rather than attempting password cracking, the adversary instantly relays the captured NetNTLMv2 challenge to an internal Active Directory Certificate Services (AD CS) web enrollment endpoint lacking EPA.

Domain Domination: The adversary requests a machine authentication certificate, impersonates the domain administrator account, requests a Golden Ticket, and gains permanent, unrestricted administrative dominance over the entire enterprise forest.