CVE-2025-24071 PoC — Microsoft Windows File Explorer Spoofing Vulnerability

Source

https://github.com/pswalia2u/CVE-2025-24071_POC

Associated Vulnerability

Title: Microsoft Windows File Explorer Spoofing Vulnerability (CVE-2025-24071)
Description:Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.

Readme

## Video Tutorial
[![CVE-2025-24071 Demo](https://img.youtube.com/vi/p6pslNlcFro/0.jpg)](https://www.youtube.com/watch?v=p6pslNlcFro)

# Windows Library File Creator (CVE-2025-24071/CVE-2025-24054 Demo)

A minimalistic Rust application that demonstrates the creation of Windows Library files (.library-ms) with configurable network paths.

## Overview

This project creates Windows Library Description (.library-ms) files that point to network shares. It's designed to demonstrate how the CVE-2025-24071 vulnerability can be exploited through GitHub Actions.

⚠️ **Educational Purposes Only**: This code is for security research and educational purposes only.

## How It Works

1. The application reads two environment variables:
   - `IP_ADDRESS`: The network IP to include in the library file (defaults to 127.0.0.1)
   - `FILE_NAME`: The name of the output file (defaults to "Increment")

2. It creates a .library-ms XML file with the specified network path (\\\\IP_ADDRESS\\shared)

3. GitHub Actions runs this code and uploads the generated file as an artifact

## GitHub Actions Workflow

The included workflow:
- Runs on manual trigger (workflow_dispatch)
- Sets up a Rust environment
- Executes the code with secrets as environment variables
- Uploads the generated .library-ms file as an artifact

## Usage

1. Fork this repository
2. Add the following secrets to your repository:
   - `IP_ADDRESS`: Target IP address
   - `FILE_NAME`: Output filename (without extension)
   - `ARTIFACT_NAME`: Name for the uploaded artifact

3. Manually trigger the workflow from the Actions tab

## Disclaimer

This tool is provided for educational purposes to demonstrate a security vulnerability. Unauthorized use against systems without explicit permission is illegal and unethical.

## PATCH/FIX
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24071

## References
https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →