# UNC path NTLM credential leak

User-influenced path or URL resolved as SMB/UNC, causing outbound NTLM auth to attacker host

_Area: Memory corruption and native code. Seen in 3 disclosed reports; one confirmed bounty: $1,000; latest 2026-10-15. Updated 2026-10-23._

## How it works

A component accepts a user-influenced string that names a resource (image, sound, file path, URI parameter) and hands it to a resolver that treats `\\host\share` or `file:////host/share` as a network location. On Windows, fetching that resource performs an SMB connection, and the OS transparently authenticates with the logged-in user's Net-NTLMv2 hash. The broken assumption: the input is treated as a local or trusted reference, but the resolver honors remote paths and the network stack volunteers credentials to any host named.

## Where it shows up

- Attacker-influenced text rendered as HTML in a rich control (e.g. Swing `JEditorPane`/`HTMLEditorKit`) where `<img src>` resolves file/UNC URLs [E1](https://bugbountylibrary.com/r/h1%3A3972558.md)
- Parser or exception messages concatenated unencoded into markup [E1](https://bugbountylibrary.com/r/h1%3A3972558.md)
- Media/notification properties (reminder sound, alert audio) accepting a remote path [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-everything-we-know-about-cve-2023-23397.md)
- URI scheme handlers with path/location parameters passed through without validation [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-unpatched-ntlm-leak-windows-search-uri-handler.md)
- Any sink that spawns SMB/WebDAV fetches (e.g. `rundll32 davclnt.dll DavSetCookie`) from a background service [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-everything-we-know-about-cve-2023-23397.md)

## How to review

Trace every user-influenced string to the point of resolution. The invariant: a value that can name a remote host must never reach an SMB/UNC/WebDAV resolver, or the resolver must reject non-local paths before any network call. Check that markup sinks escape or sanitize, that media/path properties are constrained to local files, and that URI handlers validate `location`/path parameters. Confirm the fix blocks the network fetch, not just the display.

## Variants seen

- HTML injection into a desktop log viewer's rich-text control [E1](https://bugbountylibrary.com/r/h1%3A3972558.md)
- Mail client reminder-sound property set to UNC, zero interaction [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-everything-we-know-about-cve-2023-23397.md)
- URI scheme handler `crumb=location:` accepting UNC on one click [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-unpatched-ntlm-leak-windows-search-uri-handler.md)

## Why fixes fail

Patching one URI handler left sibling schemes sharing the same activation path still leaking; the validation gap recurs across handlers [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-unpatched-ntlm-leak-windows-search-uri-handler.md).

## Impact and severity

Leaks Net-NTLMv2 hashes enabling relay or offline cracking; severity rises with zero-interaction triggers [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-everything-we-know-about-cve-2023-23397.md) and broad reach across handlers [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-unpatched-ntlm-leak-windows-search-uri-handler.md). Bounty evidence is thin (median 1000) [E1](https://bugbountylibrary.com/r/h1%3A3972558.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A3972558.md
- E2: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-everything-we-know-about-cve-2023-23397.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-unpatched-ntlm-leak-windows-search-uri-handler.md