CVE-2025-0411# CVE-2025-0411 — 7-Zip Mark-of-the-Web (MoTW) Bypass 🚨
---
### 🔍 Overview:
A vulnerability in **7-Zip** allows attackers to **bypass Windows security warnings** ⚠️ by using **double-nested archives** 📦📦. When a user extracts the archive, the **Mark-of-the-Web (MoTW)** 🚫 is removed, letting malicious files run without any prompts. This has been **exploited in real-world attacks** 🎯.
---
### 📌 Technical Details:
* **🆔 CVE ID**: CVE-2025-0411
* **🧩 Affected Component**: 7-Zip (Windows)
* **📍 Vector**: Local – user must extract the file
* **🧠 Complexity**: High (needs crafting + social engineering)
* **🙅 Privileges Needed**: None
* **👤 User Action Required**: Yes
* **💣 Impact**: Security bypass ➜ Code execution
* **🔥 Severity (CVSS 3.1)**: 7.0 (High 🔴)
---
### 💥 Exploitation in the Wild:
* 🎯 Used in phishing campaigns targeting Ukraine and Eastern Europe
* 💾 Attackers used homoglyph filenames and nested archives to **evade antivirus**
* 🐍 Delivered malware like **SmokeLoader** silently
---
### 📅 Timeline:
| 📆 Date | 🗓️ Event Description |
| ------------ | -------------------------------------------------- |
| Sep 2024 | Vulnerability discovered by internal research 🔍 |
| Oct 15, 2024 | Privately reported to vendor via Bug Bounty 💰 |
| Nov 30, 2024 | Patch released in version **v5.8.1** 🛡️ |
| Jan 10, 2025 | Public advisory published by vendor 📢 |
| Feb 6, 2025 | Added to **CISA KEV catalog** 🚨 |
| Mar 1, 2025 | Federal agencies' **patch deadline (BOD 22-01)** ⏰ |
---
### ✅ Mitigation Tips:
1. 🆙 **Update 7-Zip to v24.09+** immediately
2. 📧 Block nested archives in email gateways
3. 🧠 Train users about suspicious files & homoglyph attacks
4. 🖥️ Enforce SmartScreen + MoTW policies
5. 🕵️♂️ Hunt for unsigned executables in download folders without MoTW
---
### ⚠️ Final Advice:
This bug turns 7-Zip into a **security bypass tool** 🎭. Treat double-nested archives as suspicious, and **don’t extract untrusted files** until you're patched. Stay alert, stay patched! 🚫🦠
---
### ⚠️ Disclaimer:
This PoC is provided for educational and research purposes only. Running this on any system without permission is illegal and unethical !!!
登录后查看神龙缓存的 POC 文件快照
登录查看