The Microsoft Windows XRM-MS File NTLM Information Disclosure Spoofing vulnerability involves the handling of .xrm-ms files, which are digital license files associated with Microsoft's software licensing infrastructure. These files are registered to open by default in Internet Explorer on older systems and Microsoft Edge on newer Windows versions (Windows 7, 10, 11, and Server 2019). The vulnerability arises because the .xrm-ms file format supports embedding XML stylesheets via the xml-stylesheet processing instruction. An attacker can craft a malicious .xrm-ms file that references a remote UNC (Universal Naming Convention) path in the stylesheet's href attribute. When a user opens this file, the system attempts to load the stylesheet from the specified UNC path, triggering an outbound SMB (Server Message Block) connection to the attacker-controlled server or network share. This connection causes the Windows client to send its NTLM (NT LAN Manager) authentication hash to the attacker. The NTLM hash can be captured and potentially used in relay or offline cracking attacks to impersonate the user or escalate privileges. This attack requires user interaction to open the malicious .xrm-ms file, which can be delivered through various vectors such as email attachments, drive-by downloads, network shares, or compressed archives. Notably, the .xrm-ms file type is not commonly flagged as dangerous by email gateways or Microsoft Outlook 2016, and it bypasses several security controls including Mark of the Web (MOTW) warnings and active content security prompts. The default icon and association with Microsoft software may increase user trust and likelihood of opening the file. The exploit has been tested successfully on Windows 7, Windows 10, and Server 2019, with uncertain behavior on Windows 11 or recently updated systems. Microsoft’s security response classified the issue as a moderate spoofing vulnerability and declined to issue a patch, citing it does not meet their security bar. The exploit code is publicly available and written in Perl, demonstrating how to craft the malicious .xrm-ms file and trigger the NTLM hash leak. This disclosure enables attackers to leverage this information disclosure vector for reconnaissance or as a stepping stone in more complex attacks involving NTLM relay or credential theft.

For European organizations, this vulnerability poses a significant risk of credential leakage, particularly in environments where Windows systems are prevalent and users may receive files from external or untrusted sources. The disclosure of NTLM hashes can facilitate lateral movement within corporate networks, privilege escalation, and unauthorized access to sensitive systems. Since the attack requires user interaction, phishing campaigns or social engineering could be used to deliver the malicious .xrm-ms files. The ability to bypass common email security filters and the lack of active content warnings increase the likelihood of successful exploitation. Organizations relying on legacy Windows versions or with insufficient endpoint protection are especially vulnerable. The impact extends to confidentiality (exposure of authentication hashes), integrity (potential unauthorized access), and availability (if attackers leverage the hashes to disrupt services). Given the widespread use of Windows in European enterprises, this vulnerability could be exploited against critical infrastructure, government agencies, and private sector companies, potentially leading to data breaches and operational disruptions.

1. Implement strict email filtering rules to block or quarantine .xrm-ms files and other uncommon file types that are not essential for business operations. 2. Educate users about the risks of opening unexpected or suspicious files, especially those with uncommon extensions like .xrm-ms. 3. Disable or restrict the automatic opening of .xrm-ms files by changing file associations or using application whitelisting to prevent execution. 4. Employ network-level controls to monitor and block outbound SMB connections to untrusted or external IP addresses, mitigating NTLM hash leakage. 5. Deploy endpoint detection and response (EDR) solutions capable of detecting anomalous SMB traffic and credential theft behaviors. 6. Enforce the use of NTLMv2 with strong encryption and consider disabling NTLM authentication where feasible, migrating to Kerberos. 7. Regularly update and patch Windows systems, and monitor Microsoft advisories for any future updates related to this vulnerability. 8. Use multi-factor authentication (MFA) to reduce the risk posed by compromised NTLM hashes. 9. Review and tighten group policies related to network authentication and SMB signing to increase security against relay attacks. 10. Conduct phishing simulations and security awareness training focusing on file-based attacks and social engineering tactics.