Warning! Windows high-risk zero-day vulnerability has been exploited by hackers

On May 27, a security researcher disclosed a malicious Word document that had a surprisingly low detection rate by antivirus products. The malicious document uses a feature in Word to retrieve an HTML file from a remote server, which in turn uses MSDT to load code and execute PowerShell commands. The vulnerability is known as "Follina".

Attack Flow

Mayuresh Dani, Threat Research Manager at Qualys, said: "What is unique about this new vulnerability is that no macros were exploited in this attack." Most malicious Word documents exploit the software's macro functionality to deliver their malicious payloads. Therefore, common macro-based scanning methods cannot detect Follina. All an attacker needs to do is lure the target user into downloading a Word document or viewing an HTML file embedded with malicious code."

On Monday, May 30, Microsoft announced the vulnerability as CVE-2022-30190. The initial attacks were limited to Word, but recently, the attack surface has expanded to include RTF and Outlook. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user's rights.

Script Content

On June 14, Microsoft released Windows updates to address this vulnerability and recommended installing the updates as soon as possible.

This is one of the most critical zero-day vulnerabilities in recent times, utilizing many bypass techniques, making it difficult to patch, and easily exploitable. SecurityVerify advises organizations to remain vigilant against such vulnerabilities. SecurityVerify Labs has included this vulnerability to help users properly respond to potential attacks.

Currently, the SecurityVerify Security Metric Validation Platform is already capable of simulating attacks targeting this vulnerability (including related phishing emails, malicious file transfers, C&C, and malicious file destructive action execution). Our customers can easily verify whether their current security protection methods or mitigation measures can effectively detect and defend against attacks exploiting this vulnerability.

| References:

https://www.seqrite.com/blog/cve-2022-30190-zero-day-vulnerability-follina-in-msdt-exploited-in-the-wild/