Full Report
Huntress is monitoring a new threat against Windows OS and Microsoft Office products (CVE-2021-40444). The MSHTML engine is vulnerable to arbitrary code execution.
Analysis Summary
# Vulnerability: Microsoft MSHTML Remote Code Execution
## CVE Details
- **CVE ID:** CVE-2021-40444
- **CVSS Score:** 8.8 (High)
- **CWE:** CWE-94 (Improper Control of Generation of Code) / CWE-20 (Improper Input Validation)
## Affected Systems
- **Products:** Windows Operating System, Microsoft Office (Word, PowerPoint, Excel)
- **Versions:** All modern Windows versions (Windows 7 through 10 and Server 2008 through 2022)
- **Configurations:** Systems where Microsoft Office documents are opened or previewed, and where the MSHTML (Internet Explorer) engine is used to render content.
## Vulnerability Description
This is a remote code execution (RCE) flaw residing in **MSHTML** (also known as Trident), the browser engine used by Internet Explorer and utilized by Microsoft Office to render web content within documents. The vulnerability is triggered when a specially crafted Microsoft Office document (e.g., `.docx`, `.rtf`, `.pptx`) downloads and executes a malicious ActiveX control. Attackers use a "Cabinet" (.CAB) file to package malicious code, which is then extracted and executed on the host system when the document is opened or, in some cases, merely previewed.
## Exploitation
- **Status:** **Exploited in the Wild.** Active phishing campaigns have been observed using this flaw.
- **Complexity:** Low (requires social engineering to entice a user to open a file).
- **Attack Vector:** Network (specifically via email/phishing or web download).
- **PoC Available:** Yes. Public proof-of-concept exploits and videos have been validated by security researchers.
## Impact
- **Confidentiality:** High (Full access to user files and data)
- **Integrity:** High (Ability to modify system files and install malware)
- **Availability:** High (Potential for system instability or ransomware deployment)
## Remediation
### Patches
- **Microsoft Security Update (Sept 14, 2021):** Microsoft has released official patches. Users should apply the latest cumulative updates for their specific Windows version immediately. Huntress testing confirms the patch prevents the malicious `.cab` download in RTF files and blocks code execution in DOCX files.
### Workarounds
*Note: Workarounds were recommended prior to the patch and may not be 100% effective against all variants.*
- **Disable ActiveX Controls:** Disable the installation of all new ActiveX controls in Internet Explorer via the registry.
- **Disable Shell Preview:** Turn off "Preview Pane" and "Details Pane" in Windows File Explorer to prevent exploitation via the RTF attack vector.
- **Office Protected View:** Ensure Protected View or Application Guard for Office is enabled, which limits the execution of untrusted files.
## Detection
- **Indicators of Compromise:**
- Unusual `.cab` files downloaded from external domains via Office processes.
- Presence of `../` (directory traversal) characters within document relationship files (`.rels`).
- **Detection Methods:**
- **Antivirus:** Ensure Windows Defender or third-party EDR signatures are up to date (Microsoft has released specific signatures to detect this exploit).
- **Behavioral Monitoring:** Monitor for `winword.exe`, `excel.exe`, or `powerpnt.exe` spawning `control.exe` or executing script engines.
## References
- **Vendor Advisory:** hxxps[://]msrc[.]microsoft[.]com/update-guide/vulnerability/CVE-2021-40444
- **Huntress Technical Deep-Dive:** hxxps[://]www[.]huntress[.]com/blog/cybersecurity-advisory-hackers-are-exploiting-cve-2021-40444