Log in Request a demo

Security News

Follina: The 0-Day Vulnerability Affects Windows Systems

Follina (CVE-2022-30190) is a 0-day in the Windows Support Diagnostic Tool that lets a Word file run code. See the CVSS score, the fix and the workaround.

Brandefense logo Updated 2 Min Read
0-day vulnerability
A 0-day vulnerability called Follina, tracked as CVE-2022-30190, lets an attacker run code on a Windows system through a malicious Microsoft Word document. The flaw sits in the Microsoft Support Diagnostic Tool (MSDT). NVD lists it with a CVSS 3.1 base score of 7.8 (High). This post explains how the attack works and what to do about it.

What is the Follina 0-day vulnerability?

A 0-day vulnerability has been identified that allows threat actors to perform code execution activities on targeted Windows systems through Microsoft Office documents. It has been observed that threat actors exploiting the vulnerability called Follina obtain an HTML document from the command and control (C&C) server with the “remote template” feature of the malicious Microsoft Word document and use the ‘ms-msdt’ MSProtocol URI scheme to execute the malicious code on the target system.

How does Follina use MSDT to run code?

MSDT is a tool that collects errors that Windows users receive on the system for analysis. Threat actors can execute malicious code on the system with the MSDT tool, even if the targets do not enable macros of Microsoft Word documents. Also, converting the document to RTF format runs the code in the browser without the need to open the document. Microsoft documents Microsoft Defender detections for attempts to exploit this vulnerability. The malicious Microsoft Word document affects Office 2016 and 2021 applications.

How can you protect against Follina?

It is recommended not to open Office documents obtained from unknown parties via e-mail attachments and other vectors, benefit from comprehensive Anti-Malware solutions, and use Office applications in the most up-to-date versions.

Frequently Asked Questions.

What is the Follina vulnerability?

Follina is the name given to CVE-2022-30190, a remote code execution flaw that appears when MSDT is called through the URL protocol from an application such as Word. An attacker who exploits it can run code with the privileges of the calling application.

What is the CVSS score of CVE-2022-30190?

NVD lists a CVSS 3.1 base score of 7.8 (High), with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

How can you protect against Follina?

Install Microsoft's security update (released 14 June 2022) and follow Microsoft's published workaround, which disables the ms-msdt URL protocol. As the post advises, do not open Office documents from unknown parties and keep Office up to date.

Was Follina exploited in real attacks?

Yes. CISA's May 2022 alert said Microsoft had documented active exploitation, and CISA added CVE-2022-30190 to its Known Exploited Vulnerabilities catalog on 14 June 2022.

Sources

  1. 1 NVD: CVE-2022-30190
  2. 2 CISA: Microsoft Releases Workaround Guidance for MSDT Follina Vulnerability
  3. 3 Microsoft MSRC: Guidance for CVE-2022-30190
#0day #Follina #HTML #Microsoft #MSDT #RCE #vulnerability #windows #Zero-Day
Share

In This Article

TermsThreat actor TermsCommand and control (C2)

Where To Next.

All Security News Articles
In plain words · Glossary term Threat actor

A threat actor is an individual or a group that poses a threat to an organization or system.

Open → Keep reading · Article Misconfigured Elasticsearch Servers Targeted by Threat Actors

Threat actors delete the contents of misconfigured Elasticsearch servers and leave ransom notes.

Open → Keep reading · Article GoodWill: A New Ransomware Group Raising Attention to Social Responsibility

GoodWill ransomware asks victims for social good activities instead of money for the key.

Open →
Next in the Zero-Day file · 3 of 6Critical RCE Vulnerability Found in Mitel MiVoice VoIP Devices Actively Exploited Continue →

Knowledge HubVulnerabilities 0dayFollinaHTML