CVE-2025-0411 PoC — 7-Zip Mark-of-the-Web Bypass Vulnerability

Source

https://github.com/B1ack4sh/Blackash-CVE-2025-0411

Associated Vulnerability

Title: 7-Zip Mark-of-the-Web Bypass Vulnerability (CVE-2025-0411)
Description:7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.

Description

CVE-2025-0411

Readme

# CVE-2025-0411 — 7-Zip Mark-of-the-Web (MoTW) Bypass 🚨

---

### 🔍 Overview:

A vulnerability in **7-Zip** allows attackers to **bypass Windows security warnings** ⚠️ by using **double-nested archives** 📦📦. When a user extracts the archive, the **Mark-of-the-Web (MoTW)** 🚫 is removed, letting malicious files run without any prompts. This has been **exploited in real-world attacks** 🎯.

---

### 📌 Technical Details:

* **🆔 CVE ID**: CVE-2025-0411
* **🧩 Affected Component**: 7-Zip (Windows)
* **📍 Vector**: Local – user must extract the file
* **🧠 Complexity**: High (needs crafting + social engineering)
* **🙅 Privileges Needed**: None
* **👤 User Action Required**: Yes
* **💣 Impact**: Security bypass ➜ Code execution
* **🔥 Severity (CVSS 3.1)**: 7.0 (High 🔴)

---

### 💥 Exploitation in the Wild:

* 🎯 Used in phishing campaigns targeting Ukraine and Eastern Europe
* 💾 Attackers used homoglyph filenames and nested archives to **evade antivirus**
* 🐍 Delivered malware like **SmokeLoader** silently


![bug2](https://github.com/user-attachments/assets/5608ec55-449a-4175-95e2-a5da023de6bb)

---

### 📅 Timeline:


| 📆 Date      | 🗓️ Event Description                              |
| ------------ | -------------------------------------------------- |
| Sep 2024     | Vulnerability discovered by internal research 🔍  |
| Oct 15, 2024 | Privately reported to vendor via Bug Bounty 💰     |
| Nov 30, 2024 | Patch released in version **v5.8.1** 🛡️           |
| Jan 10, 2025 | Public advisory published by vendor 📢            |
| Feb 6, 2025  | Added to **CISA KEV catalog** 🚨                   |
| Mar 1, 2025  | Federal agencies' **patch deadline (BOD 22-01)** ⏰ |

---

### ✅ Mitigation Tips:

1. 🆙 **Update 7-Zip to v24.09+** immediately
2. 📧 Block nested archives in email gateways
3. 🧠 Train users about suspicious files & homoglyph attacks
4. 🖥️ Enforce SmartScreen + MoTW policies
5. 🕵️‍♂️ Hunt for unsigned executables in download folders without MoTW

---

### ⚠️ Final Advice:

This bug turns 7-Zip into a **security bypass tool** 🎭. Treat double-nested archives as suspicious, and **don’t extract untrusted files** until you're patched. Stay alert, stay patched! 🚫🦠

---

### ⚠️ Disclaimer:

This PoC is provided for educational and research purposes only. Running this on any system without permission is illegal and unethical !!!

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →