Full Report
Mark of the Web (MOTW) is used on Windows to say if something was downloaded from the internet. For executables, zip files and other things, this is an important thing to mitigate many attack vectors. In practice, browsers will add an Alternate Data Stream (ADS) named Zone Identifier. The author noticed a video on Twitter demonstrating a vulnerability where a downloaded zip file was not getting the MOTW flag. One of these was tricky using other file extensions that use zip under the hood (APK, ISO, etc.) and the other was simply a zip file. Microsoft had let the 90 day deadline pass so the video was posted. The author of this post wondered - can I replicate this? From the video, the extraction bug ONLY occurs when explorer.exe is doing the handling. Additionally, from the video, the zip file itself has the MOTW but the extracted files do not. By looking at hooks and functions being executed, the author found the function ExtractFromZipToFile() within the DLL zipfldr.dll. To find out what function was responsible for the MOTW functionality, they reverse engineered things and NOPed out a few function calls. From doing this, they noticed that if the function CheckUnZippedFile was skipped then the MOTW flag wouldn't be added to the files. So, how do we skip this function or bypass the flag adding? The author attempts to trigger errors via weird characters, long file names and other things in order to bypass the flag adding to the files. Since none of these worked, the author found a live sample of this bypass and reverse engineered the sample. Reverse engineering the sample led them down a rabbit hole of different functions. Eventually, when they found Alice, they came out of it with an interesting note: the files that were not getting flagged were marked as Read Only. Since the flag is technically writing to the file, the flag writing would occur with an access denied error. The bug turned out to be very simple but required a good understanding of zip and Windows Internals. Overall, a good writeup with some good Windows reverse engineering tips.
Analysis Summary
# Vulnerability: Windows ZIP Extraction Bypass of Mark-of-the-Web (MOTW)
## CVE Details
- CVE ID: CVE-2022-41049
- CVSS Score: Not explicitly stated in the text, but described as a vulnerability that bypassed security warnings. (Severity is implied as **High** due to security bypass)
- CWE: CWE-20 (Improper Input Validation) - *Inferred, based on path manipulation failure.*
## Affected Systems
- Products: Microsoft Windows (Specifically the default ZIP handling mechanism used by `explorer.exe`).
- Versions: Not explicitly listed, but patched by Microsoft after a 90-day disclosure period leading up to October 2022.
- Configurations: Occurs when files are extracted from a ZIP archive by `explorer.exe` using the built-in Windows ZIP folder functionality (`zipfldr.dll`).
## Vulnerability Description
The vulnerability resides in how Windows Explorer handles the extraction of files from ZIP archives, specifically within the `ExtractFromZipToFile()` function in the `zipfldr.dll` module. When files are extracted, the system attempts to apply the Mark-of-the-Web (MOTW) security flag (stored as a `Zone.Identifier` Alternate Data Stream - ADS) to the extracted contents.
The flaw is triggered because the function responsible for applying the MOTW flag, `CheckUnZippedFile`, fails silently or is skipped under specific conditions. In the observed bypass, files extracted from certain archives (like those created by dragging contents from a Read-Only mounted ISO first) retained a "Read Only" attribute. When `CheckUnZippedFile` attempted to write the MOTW ADS to these Read Only files, the operation failed with an "access denied" error because writing to the file attribute is treated as a file write operation. Skipping this check results in the extracted files lacking the necessary MOTW flag, allowing them to execute without the standard security warning pop-up.
## Exploitation
- Status: PoC available (demonstrated via Twitter video and described in the article). The vulnerability was a 0-day prior to patching.
- Complexity: Medium to High (Initial discovery required advanced Windows internals knowledge and reverse engineering of `zipfldr.dll`). The final bypass relied on a simple file attribute interaction (`Read Only`).
- Attack Vector: Local (Requires the user to download and extract a specially crafted ZIP file using `explorer.exe`).
## Impact
- Confidentiality: Potential impact if malware is executed without user warning.
- Integrity: Potential impact if malicious code is executed without user warning, allowing unauthorized system changes.
- Availability: Minimal direct impact, but execution of malicious payloads could lead to system compromise or disruption.
## Remediation
### Patches
- Microsoft released a patch addressing CVE-2022-41049 after the mandatory 90-day disclosure waiting period. (Specific patch version not detailed in the summary text.)
### Workarounds
- Do not use the built-in Windows Explorer ZIP extraction feature for untrusted archives; utilize third-party tools like 7-Zip (with MOTW feature manually enabled) for extraction.
## Detection
- **Indicators of compromise:** Executables running immediately after extraction from a ZIP file without displaying the Windows security warning dialog.
- **Detection methods and tools:** Monitoring file system operations related to the creation of `Zone.Identifier` Alternate Data Streams on newly extracted files. Monitoring for processes that fail to set file permissions correctly during extraction.
## References
- Vendor advisories: Microsoft Security Update referenced by CVE-2022-41049.
- Relevant links - defanged: (Article source link is the primary reference) `hxxps://breakdev.org/exploring-zip-mark-of-the-web-bypass-vulnerability-cve-2022-41049/`