Cyber Security
Windows MSDT zero-day vulnerability gets free unofficial patch
A free unofficial patch is now available to block ongoing attacks against Windows systems that target a critical zero-day vulnerability known as ‘Follina.’
The bug, now tracked as CVE-2022-30190 and described by Redmond as a Microsoft Windows Support Diagnostic Tool (MSDT) remote code execution flaw, impacts all Windows versions still receiving security updates (Windows 7+ and Server 2008+).
Attackers who successfully exploit this zero-day can execute arbitrary code with the privileges of the calling app to install programs, view, change, or delete data, or create new Windows accounts as allowed by the user’s rights.
While Microsoft has not issued security updates to address this actively exploited zero-day, the company has shared mitigation measures to block attacks by disabling the MSDT URL protocol malicious actors use to execute code on vulnerable systems.
It would be best to toggle off the Preview pane in Windows Explorer to remove it as an additional attack vector exploitable when previewing malicious documents.
Secure your system until an official fix is available
This is where the 0patch micropatching service comes in, with free (and unofficial) micropatches for some versions of Windows impacted by the Follina security bug:
- Windows 11 v21H2
- Windows 10 (from v1803 to v21H2)
- Windows 7
- Windows Server 2008 R2
Instead of disabling the MSDT URL protocol handler (as advised by Microsoft), 0patch has added sanitization of the user-provided path (currently missing in the Windows script) to avoid rendering the Windows diagnostic wizardry inoperable across the OS for all applications.
“Note that it doesn’t matter which version of Office you have installed, or if you have Office installed at all: the vulnerability could also be exploited through other attack vectors,” 0patch co-founder Mitja Kolsek said
“That is why we also patched Windows 7, where the ms-msdt: URL handler is not registered at all.”
To deploy this micropatch on your Windows system (for free until Microsoft has issued an official fix), you must register a 0patch account and install the 0patch agent.
Once the agent is launched, it will automatically download and apply the patch unless local security policies prevent that.
Exploited in ongoing attacks
On Monday, enterprise security firm Proofpoint revealed that the China-linked TA413 hacking group is now exploiting this vulnerability in attacks against their favorite target, Tibetan diaspora dissidents.
Security researcher MalwareHunterTeam also spotted malicious documents with Chinese filenames being in the wild used to deploy password-stealing trojans via http://coolrat[.]xyz.
However, the first CVE-2022-30190 attacks were spotted over a month ago using sextortion threats and invitations to Sputnik Radio interviews as baits, as a sign that the flaw was and is likely being exploited by other threat actors.
CISA has also urged Windows admins and users to disable the MSDT protocol after Microsoft reported active exploitation of the vulnerability in the wild.
Shadow Chaser Group’s CrazymanArmy, the security researcher who reported the zero-day in April, said Microsoft rejected his submission as not a “security-related issue.” However, Redmond later closed the vulnerability submission report with a remote code execution impact.