Attackers are exploiting zero-day RCE flaw to target Windows users (CVE-2021-40444)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-40444 | Remote Code Execution via MSHTML Rendering Engine in Microsoft Windows/Office (CVE-2021-40444) CVE-2021-40444 is a remote code execution vulnerability in the Microsoft MSHTML browser rendering engine, which Microsoft Office documents can load on Windows systems. It is triggered when a user is convinced to open a specially crafted Office document containing a malicious ActiveX control hosted by the MSHTML engine (tracked as a path-traversal-class issue, CWE-22). A successful attacker gains the ability to run arbitrary code in the context of the logged-on user, with greater impact when that user has administrative rights. Any Windows system that can open Office documents is exposed, spanning Windows 7, 8.1, RT 8.1, Windows 10 (1507 through 21H1) and Windows Server 2004/2008. Exploitation is confirmed in the wild: Microsoft observed targeted attacks at disclosure, the flaw is in CISA's KEV with known ransomware use, and Microsoft released security updates on September 14, 2021. Do: Apply Microsoft's security updates released September 14, 2021 for your Windows version immediately; this is a CISA KEV item with known ransomware use, so patching is treated as mandatory. As interim protection, keep Microsoft Defender Antivirus/Defender for Endpoint signatures current (enterprise detection build 1.349.22.0 or newer, with alerts appearing as 'Suspicious Cpl File Execution') and avoid opening untrusted Office documents, since exploitation requires user interaction with a crafted file. | 8.8 | 97% | KEV ransomware PoC ×2 |
| masshundreds of millions of Windows PCs and servers (nearly all Windows desktop/laptop installs on affected versions at disclosure) |
Full article380 words · extracted from helpnetsecurity.com · click to collapse
Attackers are exploiting CVE-2021-40444, a zero-day remote code execution vulnerability in MSHTML (the main HTML component of the Internet Explorer browser), to compromise Windows/Office users in “a limited number of targeted attacks,” Microsoft has warned on Tuesday.
About CVE-2021-40444 and the attacks
CVE-2021-40444 is a set of logical flaws that can be leveraged by remote, unauthenticated attackers to execute code on the target system.
The current attacks were detected by Microsoft, Mandiant, and Expmon researchers. The latter say that they’ve reliably reproduced the attack on Windows 10:
We have reproduced the attack on the latest Office 2019 / Office 365 on Windows 10 (typical user environment), for all affected versions please read the Microsoft Security Advisory. The exploit uses logical flaws so the exploitation is perfectly reliable (& dangerous).
— EXPMON (@EXPMON_) September 7, 2021
The attackers are flinging specially-crafted Microsoft Office documents at targets.
“An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document,” Microsoft explained.
The company also noted that “Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights,” and that Microsoft Office opens documents from the internet in Protected View or Application Guard for Office by default, and that this prevents the current attacks.
Unfortunately, users are often tricked into opening documents from untrusted sources and to exit the Protected View.
To contextualise this, Protected View also protects against macros.. which are the single biggest source of malware in the security industry, as “Enable Content” in the UI disables it.
Application Guard for Office is an E5 only feature and isn’t used to open docs by default. pic.twitter.com/IiaCic9EWJ
— Kevin Beaumont (@GossiTheDog) September 7, 2021
Until a patch is released, Microsoft has advised admins to disable ActiveX in Internet Explorer to mitigate the risk (instructions on how to do it are included in the security advisory).
“At this point, it should be pretty low impact to disable ActiveX, but of course, there may be individual enterprise applications that still use ActiveX,” noted Dr. Johannes Ullrich, Dean of Research at the SANS Technology Institute.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/09/08/cve-2021-40444/