Cisco Talospublished Jun 1, 14:19 UTC (Jun 1, 2022)ingested Sep 10, 06:19 UTCNick Biasini

Threat Advisory: Zero-day vulnerability in Microsoft diagnostic tool MSDT could lead to code execution

criticalExploit / PoCimportance 60CVE-2022-30190

Read the original

Tagscve-2022-30190 exploit

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2022-30190	MSDT URL Protocol Remote Code Execution in Microsoft Windows (Follina) CVE-2022-30190 (Follina) is a remote code execution flaw in the Microsoft Windows Support Diagnostic Tool (MSDT) when MSDT is invoked through its ms-msdt URL protocol by a calling application such as Microsoft Word. Attackers trigger it by luring a user into opening a malicious document — typically a Word/RTF file whose link or remotely linked template launches the ms-msdt: URI with attacker-supplied commands — and CVSS 3.1 rates it 7.8 with a local attack vector and required user interaction. A successful exploit runs arbitrary code with the privileges of the calling application, allowing the attacker to install programs, view, change or delete data, or create new accounts in the user's context. Per the CISA data, affected platforms are Windows 7, 8.1 and RT 8.1, Windows 10 versions 1507 through 21H2, Windows 11 21H2, and Windows Server 2008 and 2012 — essentially any Windows installation that ships MSDT, with Office/Word as the common delivery vector. Exploitation is confirmed in the wild: Microsoft acknowledged it as an exploited zero-day, CISA added it to the KEV on 2022-06-14 with known ransomware use, EPSS puts the 30-day exploitation probability at 99.2% (99th percentile), and contemporaneous reporting also tied its use to espionage actors including APT28. Do: Apply Microsoft's security updates per vendor instructions (the fix shipped in the June 2022 Patch Tuesday releases for the affected Windows versions), as required by CISA's KEV. If patching must be delayed, follow Microsoft's documented mitigation to disable the MSDT URL protocol (remove or restrict the HKEY_CLASSES_ROOT\ms-msdt registry key) and enforce Office Protected View / block Word from fetching remote templates over the network. Hunt for exploitation by checking whether Office processes (WINWORD.exe) launch msdt.exe or sdiagnhost.exe, or whether ms-msdt: URIs are invoked unexpectedly.	7.8	99%	KEV ransomware PoC	Microsoft Windows 10 1507, 1607, 1809, 20H2, 21H1, 21H2 Microsoft Windows 11 21H2 Microsoft Windows 7 +4 more	mass≈1 billion+ Windows devices (effectively the entire supported Windows installed base)	Jun 1, 2022

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2022-30190

MSDT URL Protocol Remote Code Execution in Microsoft Windows (Follina)

CVE-2022-30190 (Follina) is a remote code execution flaw in the Microsoft Windows Support Diagnostic Tool (MSDT) when MSDT is invoked through its ms-msdt URL protocol by a calling application such as Microsoft Word. Attackers trigger it by luring a user into opening a malicious document — typically a Word/RTF file whose link or remotely linked template launches the ms-msdt: URI with attacker-supplied commands — and CVSS 3.1 rates it 7.8 with a local attack vector and required user interaction. A successful exploit runs arbitrary code with the privileges of the calling application, allowing the attacker to install programs, view, change or delete data, or create new accounts in the user's context. Per the CISA data, affected platforms are Windows 7, 8.1 and RT 8.1, Windows 10 versions 1507 through 21H2, Windows 11 21H2, and Windows Server 2008 and 2012 — essentially any Windows installation that ships MSDT, with Office/Word as the common delivery vector. Exploitation is confirmed in the wild: Microsoft acknowledged it as an exploited zero-day, CISA added it to the KEV on 2022-06-14 with known ransomware use, EPSS puts the 30-day exploitation probability at 99.2% (99th percentile), and contemporaneous reporting also tied its use to espionage actors including APT28.

Do: Apply Microsoft's security updates per vendor instructions (the fix shipped in the June 2022 Patch Tuesday releases for the affected Windows versions), as required by CISA's KEV. If patching must be delayed, follow Microsoft's documented mitigation to disable the MSDT URL protocol (remove or restrict the HKEY_CLASSES_ROOT\ms-msdt registry key) and enforce Office Protected View / block Word from fetching remote templates over the network. Hunt for exploitation by checking whether Office processes (WINWORD.exe) launch msdt.exe or sdiagnhost.exe, or whether ms-msdt: URIs are invoked unexpectedly.

7.8

99%

KEV ransomware PoC

Microsoft Windows 10 1507, 1607, 1809, 20H2, 21H1, 21H2
Microsoft Windows 11 21H2
Microsoft Windows 7
+4 more

mass≈1 billion+ Windows devices (effectively the entire supported Windows installed base)

Jun 1, 2022

Indicators of compromiseauto-extracted · verify before use · export allAll →

Type	Indicator	Context
domain	3134.html	DF842l[.]html hxxps[://]www[.]sputnikradio[.]net/radio/news/3134[.]html hxxps[://]exchange[.]oufca[.]com[.]au/owa/auth/15[.]1[.]2
domain	exchange.oufca.com.au	/]www[.]sputnikradio[.]net/radio/news/3134[.]html hxxps[://]exchange[.]oufca[.]com[.]au/owa/auth/15[.]1[.]2375/themes/p3azx[.]html
domain	p3azx.html	/]exchange[.]oufca[.]com[.]au/owa/auth/15[.]1[.]2375/themes/p3azx[.]html
domain	rdf842l.html	w[.]xmlformats[.]com/office/word/2022/wordprocessingDrawing/RDF842l[.]html hxxps[://]www[.]sputnikradio[.]net/radio/news/3134[.]html
domain	www.sputnikradio.net	ce/word/2022/wordprocessingDrawing/RDF842l[.]html hxxps[://]www[.]sputnikradio[.]net/radio/news/3134[.]html hxxps[://]exchange[.]oufca[.]com
domain	www.xmlformats.com	eb37edce014e34a94b8fd0020796ff1ef7 Malicious URLs hxxps[://]www[.]xmlformats[.]com/office/word/2022/wordprocessingDrawing/RDF842l[.]html h
sha256	4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784	is threat: Win.Exploit.CVE_2022_30190-9951234-1 IOCs Hashes 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784 8e986c906d0c6213f80d0224833913fa14bc4c15c047766a62f6329bfc0
sha256	710370f6142d945e142890eb427a368bfc6c5fe13a963f952fb884c38ef06bfa	467c2714f4962d814a34f8ee631a51e8255b9c07106d44c6a1f1eda7a45 710370f6142d945e142890eb427a368bfc6c5fe13a963f952fb884c38ef06bfa d61d70a4d4c417560652542e54486beb37edce014e34a94b8fd0020796f
sha256	8e986c906d0c6213f80d0224833913fa14bc4c15c047766a62f6329bfc0639bd	48f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784 8e986c906d0c6213f80d0224833913fa14bc4c15c047766a62f6329bfc0639bd fe300467c2714f4962d814a34f8ee631a51e8255b9c07106d44c6a1f1ed
sha256	d61d70a4d4c417560652542e54486beb37edce014e34a94b8fd0020796ff1ef7	0f6142d945e142890eb427a368bfc6c5fe13a963f952fb884c38ef06bfa d61d70a4d4c417560652542e54486beb37edce014e34a94b8fd0020796ff1ef7 Malicious URLs hxxps[://]www[.]xmlformats[.]com/office/word
sha256	fe300467c2714f4962d814a34f8ee631a51e8255b9c07106d44c6a1f1eda7a45	c906d0c6213f80d0224833913fa14bc4c15c047766a62f6329bfc0639bd fe300467c2714f4962d814a34f8ee631a51e8255b9c07106d44c6a1f1eda7a45 710370f6142d945e142890eb427a368bfc6c5fe13a963f952fb884c38ef

Full article573 words · extracted from blog.talosintelligence.com · click to collapse

Wednesday, June 1, 2022 10:19

A recently discovered zero-day vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT) made headlines over the past few days. CVE-2022-30190, also known under the name "Follina," exists when MSDT is called using the URL protocol from an application, such as Microsoft Office, Microsoft Word or via an RTF file. An attacker could exploit this vulnerability to gain the ability to run arbitrary code on the targeted system.

Although a patch hasn't been released yet, Microsoft has provided workaroundsand Windows Defender protections for the CVE and malware exploiting this vulnerability. Cisco Talos has also released coverage to protect against this vulnerability, the full details of which are available below.

The most direct workaround is to disable the MSDT URL protocol by launching the command prompt as administrator and running the following commands:

To back up the existing registry values, run "reg export HKEY_CLASSES_ROOT\ms-msdt filename" where filename is the name of the backup you will be creating.
To implement the workaround, run "reg delete HKEY_CLASSES_ROOT\ms-msdt /f"
To undo the work around, run "reg import filename" where filename is the name assigned in the steps above.

Ongoing exploitation

Cisco Talos is aware of ongoing exploitation in the wild, so users are encouraged to test and implement the workaround as quickly as possible to mitigate risk.

An example of a maldoc exploiting this vulnerability consists of configuring the external references of the maldoc to point to the exploit payload, which, in this case, is written in HTML.

The HTML hosted on the remote location contains the actual exploit.

Using the ms-msdt schema and troubleshooting package "PCWDiagnostic," the attacker can launch arbitrary code on the infected endpoint.

Coverage

Ways our customers can detect and block this threat are listed below.

Cisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.

Cisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.

Cisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.

Cisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.

Cisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.

Umbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.

Cisco Secure Web Appliance (formerly Web Security Appliance) automatically blocks potentially dangerous sites and tests suspicious sites before users access them.

Additional protections with context to your specific environment and threat data are available from the Firewall Management Center.

Cisco Duoprovides multi-factor authentication for users to ensure only those authorized are accessing your network.

Open-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

Talos created the following Snort coverage for CVE-2022-30190:
Snort 2: 59889 - 59894
Snort 3: 300192 - 300194

The following ClamAV signatures are available to detect malware related to this threat:

Win.Exploit.CVE_2022_30190-9951234-1

IOCs

Hashes

4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
8e986c906d0c6213f80d0224833913fa14bc4c15c047766a62f6329bfc0639bd
fe300467c2714f4962d814a34f8ee631a51e8255b9c07106d44c6a1f1eda7a45
710370f6142d945e142890eb427a368bfc6c5fe13a963f952fb884c38ef06bfa
d61d70a4d4c417560652542e54486beb37edce014e34a94b8fd0020796ff1ef7

Malicious URLs

hxxps[://]www[.]xmlformats[.]com/office/word/2022/wordprocessingDrawing/RDF842l[.]html
hxxps[://]www[.]sputnikradio[.]net/radio/news/3134[.]html
hxxps[://]exchange[.]oufca[.]com[.]au/owa/auth/15[.]1[.]2375/themes/p3azx[.]html

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/msdt-follina-coverage/