Full Report
A new attack vector enables hackers to more easily compromise users with malicious Microsoft Office documents.
Analysis Summary
# Vulnerability: Follina Microsoft Support Diagnostic Tool (MSDT) RCE
## CVE Details
- **CVE ID:** CVE-2022-30190
- **CVSS Score:** 7.8 (High)
- **CWE:** CWE-94 (Improper Control of Generation of Code)
## Affected Systems
- **Products:** Microsoft Windows and Microsoft Office
- **Versions:** Multiple Windows versions including Windows 7, 8.1, 10, 11, Server 2008, 2012, 2016, 2019, and 2022.
- **Configurations:** Systems where the MSDT URL protocol is enabled. The exploit is particularly potent when triggered via Microsoft Word, even through the "hover-preview" feature in Windows Explorer.
## Vulnerability Description
This is a remote code execution (RCE) vulnerability that exists when MSDT is called using the URL protocol from a calling application such as Word. A remote attacker can craft a malicious .docx or .rtf file that uses a "remote template" feature to fetch an HTML file from a remote server. This HTML file contains a script that invokes the `ms-msdt://` URI scheme with specific parameters (such as the `IT_BrowseForFile` argument) to execute PowerShell commands. Because the execution is handled via the diagnostic tool, it can bypass Protected View and Macro security settings.
## Exploitation
- **Status:** Exploited in the wild; PoC available.
- **Complexity:** Low
- **Attack Vector:** Network (Remote via malicious document delivery)
## Impact
- **Confidentiality:** High (Attacker can view all data accessible to the user)
- **Integrity:** High (Attacker can install programs, change data, or create new accounts)
- **Availability:** High (Attacker can delete data or disrupt services)
## Remediation
### Patches
- Microsoft released official security updates on June 14, 2022. Users should apply the cumulative Windows updates specific to their OS version (e.g., KB5014699 for Windows 10, KB5014697 for Windows 11).
### Workarounds
- **Disable MSDT URL Protocol:**
1. Run Command Prompt as Administrator.
2. Back up the registry key: `reg export HKEY_CLASSES_ROOT\ms-msdt filename`
3. Execute the command: `reg delete HKEY_CLASSES_ROOT\ms-msdt /f`
- **Disable Previews:** Disable the Preview pane in Windows Explorer to prevent "zero-click" execution when navigating to folders containing malicious files.
## Detection
- **Indicators of Compromise:**
- `sdiagnhost.exe` spawning suspicious child processes (e.g., `cmd.exe`, `powershell.exe`).
- Network connections to unusual remote hosts fetching HTML files from Office documents (e.g., the original `xmlformats[.]com`).
- **Detection Methods:** Monitor for Microsoft Word or Excel spawning `msdt.exe`. Huntress and other security vendors have provided Sigma rules and EDR telemetry queries to identify the specific command-line arguments used by the exploit.
## References
- **Vendor Advisory:** [https[:]//msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-30190]
- **Microsoft Guidance:** [https[:]//msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/]
- **Original Analysis:** [https[:]//www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug]