A newly numbered Windows zero-day vulnerability (CVE-2022-30190) is being exploited in the wild via specially crafted Office documents (without macros), security researchers are warning.
After initially dismissing the vulnerability as “not a security related issue”, Microsoft has now issued a CVE and has offered a temporary workaround until fixes can be provided.
Detected attacks
Boobytrapped office files delivered via email are one of the most common tactics attackers use to compromise endpoints, and they are constantly finding new ways to hide the documents’ malicious nature from existing security defenses, solutions, as well as users/targets.
Attackers have been exploiting Office macros to deliver exploits and malware for ages, but since Microsoft has (finally!) made it so that the default behavior of Office applications is to block macros in files from the internet, attackers are testing new approaches.
In the wild, attackers have been exploiting CVE-2022-30190 (in the meantime dubbed “Follina”) to target Russian and Belarussian targets since April:
About CVE-2022-30190
“A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights,” Microsoft noted in the security advisory released on Monday.
The attack itself is carried out locally, the company explained, but the attacker can be remote.
“Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).”
Security researcher Kevin Beaumont found by analyzing the latest malicious document leveraged by attackers that “the document uses the Word remote template feature to retrieve a HTML file from a remote webserver, which in turn uses the ms-msdt MSProtocol URI scheme to load some code and execute some PowerShell.”
Microsoft says that Microsoft Office opens documents from the internet in Protected View or Application Guard for Office, and that both prevent the current attack.
Both Beaumont and Huntress researchers have noted that, while Protected View will kick in this particular case, changing the document to a .rtf file could trigger the exploit with just the Preview Pane in Windows Explorer and will not trigger Protected View.
“Much like CVE-2021-40444, this extends the severity of this threat by not just ‘single-click’ to exploit, but potentially with a ‘zero-click’ trigger,” Huntress researcher John Hammond noted.
After successful exploitation, attackers have only the system privileges given to the user (account) that interacted with the malicious file, but they can use other exploits to gain higher privileges.
Several security researchers have been trying out PoC exploits and found that Office 2013, 2016, 2021 are vulnerable. The vulnerable nature of other versions is still to be confirmed.
Mitigation
Microsoft advises disabling the Microsoft Support Diagnostic Tool (MSDT) URL Protocol.
Customers using Microsoft Defender Antivirus “should turn-on cloud-delivered protection and automatic sample submission” and those using Microsoft Defender for Endpoint can enable the attack surface reduction rule that blocks Office apps from creating child processes, the company added.
“Another option is to remove the file type association for ms-msdt (can be done in Windows Registry HKCR:\ms-msdt or with Kelvin Tegelaar’s PowerShell snippet),” Hammond also pointed out, but added that changing settings in the Windows Registry “is serious business because an incorrect Registry entry could brick your machine.”
Finally, organizations should (for the millionth time) warn employees not to open unsolicited attachments and, in this case, to not even hover over a downloaded file, but we all know that counting on every user to do this is unrealistic.
Luckily, there is currently no indication that attacks exploiting CVE-2022-30190 are widespread.
