Follina: 0-day Windows MSDT Vulnerability (CVE-2022-30190) Exploited In The Wild

A 0-day vulnerability in Microsoft Support Diagnostic Tool is being exploited in the wild. The first sample that exploits the vulnerability appeared on VirusTotal on April 12th, 2022. Assigned CVE-2022-30190, successful exploitation allows an attacker to run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights.

Why is the Significant?

This is significant because the vulnerability is a 0-day vulnerability in Microsoft Support Diagnostic Tool that allows remote code execution and is being exploited in the wild.

What is CVE-2022-30190?

The vulnerability is a remote code execution vulnerability that was named “Follina” by a security researcher Kevin Beaumont. The name “Follina” was derived from the 0-day code referencing “0438”, which is the area code of Follina, Italy. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application such as Word. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights.

A malicious Word file that is widely discussed online abuses the remote template feature in Microsoft Word and retrieves a remote HTML file. The retrieved HTML file uses the “ms-msdt” MSProtocol URI scheme to load and execute the PowerShell payload. Note that ms-msdt refers to “Microsoft Support Diagnostic Tool”, which a legitimate Microsoft tool collects and sends system information back to the Microsoft for problem diagnostic.

What is concerning is that the vulnerability reportedly can be exploited if even if macros, one of the most prevalent ways to deliver malware via Microsoft Office files, are disabled. Also, if the document file is changed to RTF form, even previewing the document in Windows Explorer can trigger the exploit.

How Widespread is this?

While the attack that leverages the vulnerability does not appear to be widespread, however more attacks are expected as Proof-of-Concept code is available and a patch has not yet been released.

Does the Vulnerability Have CVE Number?

CVE-2022-30190 has been assigned to the vulnerability.

Has Microsoft Released an Advisory?

Yes. See the Appendix for a link to”>Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability”.

Has Microsoft Released a Patch?

No, Microsoft has not released a patch yet.

What is the Status of Coverage?

FortiGuard Labs provides the following AV coverage against the known samples that are associated with CVE-2022-30190:

MSWord/Agent.2E52!tr.dldr
MSOffice/Agent.DIT!tr
HTML/CVE_2022_30190.A!tr
MSIL/Agent.2E52!exploit
W32/Agent.2E52!exploit
LNK/Agent.2E52!exploit
Data/Agent.2E52!exploit
MSWord/CVE20170199.A!exploit
Riskware/RemoteShell

Regarding IPS coverage, the following signature will detect the retrieval of remote HTML files that contain the MSDT command:

MS.Office.MSHTML.Remote.Code.Execution.

Known network IOCs for CVE-2022-30190 are blocked by the WebFiltering client.

FortiEDR will provide protection from exploitation of this vulnerability and subsequent post-exploitation activity. See the Appendix for a link to “Technical Tip: How FortiEDR protects against CVE-2022-30190 ‘Follina’ Microsoft Office protocol vulnerability” for more information.

Th FortiGuard Content Disarm and Reconstruction (CDR) service can to detect the attack in real-time and prevent it by disarming the “oleobject” data from Microsoft Office files.

FortiGuard Labs is currently investigating for additional coverage against CVE-2022-30190. This Threat Signal will be updated when additional information becomes available.

Any Suggested Mitigation?

Microsoft released an official blog on CVE-2022-30190 that includes mitigation information. See the Appendix for a link to “Guidance for CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability”.

Appendix

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability (Microsoft)

Guidance for CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability (Microsoft)

CVE-2022-30190 (MITRE)

Follina — a Microsoft Office code execution vulnerability (DoublePulsar)

Microsoft Releases Workaround Guidance for MSDT “Follina” Vulnerability (US-CERT)

MS.Office.MSDT.Remote.Code.Execution (Fortinet)

Technical Tip: How FortiEDR protects against CVE-2022-30190 ‘Follina’ Microsoft Office protocol vulnerability (Fortinet)

Technical Tip: Using FortiAnalyzer to detect Follina Microsoft Office RCE vulnerability | CVE-2022-30190 (Fortinet)

Source

Suggest an edit to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

• Globally, 30,000 websites are hacked daily.
• 64% of companies worldwide have experienced at least one form of a cyber attack.
• There were 20M breached records in March 2021.
• In 2020, ransomware cases grew by 150%.
• Email is responsible for around 94% of all malware.
• Every 39 seconds, there is a new attack somewhere on the web.
• An average of around 24,000 malicious mobile apps are blocked daily on the internet.