microsoft turned me down

The video explores CVE-2025-33053, a Windows URL file vulnerability that enabled remote code execution through proxy execution from a WebDAV server 1:16, and demonstrates that similar functionality exists in regular Windows LNK shortcut files, which Microsoft did not consider a security boundary requiring a patch 25:00.

Key Takeaways:
• CVE-2025-33053 was a vulnerability in URL internet shortcut files that allowed remote code execution by setting the working directory to an attacker-controlled WebDAV server 3:01
• The vulnerability exploited how ie_diagcmd.exe searches for executables, checking the current working directory before system directories 7:31
• Microsoft patched the URL file vulnerability in June 2025, but regular Windows LNK shortcut files can still be used similarly 22:25
• The creator reported this LNK file technique to Microsoft, but they closed the case stating it requires social engineering and doesn't cross a security boundary 33:27
• The LNK shortcut method was still working on the latest Windows Insider build at the time of recording 36:25

The video demonstrates that while Microsoft patched the URL file vulnerability, similar functionality remains available through Windows LNK shortcuts, highlighting the complexity of determining security boundaries 37:04.

Sources:

• 1:16 Introduction to CVE-2025-33053 and how the vulnerability works
• 3:01 Explanation of how the URL file vulnerability exploited WebDAV ser