On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool (MSDT) in Windows vulnerability. This vulnerability is also known as “Follina”. This vulnerability primarily involves Microsoft Office, and could allow an attacker to install malware by sending a specially crafted Office document to a user. The user does not have to open the document for the malicious code in it to run, previewing the document is enough for the exploit to work.
What this means
We expect to see an uptick in the number of malicious emails as attackers move to take advantage of this vulnerability due to several factors:
- This vulnerability is present in versions of Windows that do not have the June 2022 Cumulative Updates applied, and can be exploited through Microsoft 365, Office 2013 through 2019, Office 2021, and Office ProPlus.
- It commonly utilizes a file type users commonly work with: Word files (currently .doc, .docx and .rtf files)
- Threat actors are also using this exploit in malicious HTML content and in malicious URLs sent via email.
- It allows remote code execution, and the attacker can use it to gain administrative privileges, even if the targeted user does not have them.
- This exploit works even if Protected Mode is on, and Macros are disabled.
- The file does not have to be opened by the recipient, simply previewing it is enough for it to execute.
However, this is no cause for panic. There is now a patch available, workarounds exist for machines that cannot be immediately updated, and detections are available via several security products.
Existing Clients (Managed)
Your devices have been patched, no action is needed on your part. Outside of that, as always, remain vigilant when receiving unusual email messages. This is where your training will pay off!
Everyone Else
Exercise caution when receiving email from unknown sources, especially those containing Office attachments, as this has become a popular delivery method. While many of the working exploits have utilized Word or Rich Text Format files, attackers have modified this exploit to utilize other methods, such as malicious URLs and HTML content.
On 6/14/2022, Microsoft patched this vulnerability in the June 2022 Cumulative Updates.
Workaround (for devices that cannot be immediately patched): Microsoft Security Response Center: Guidance for CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability
Vigilance on your part will go a long way in mitigating the risk from this new vulnerability. Stay calm, stay sharp.
This post will be updated as new information is available. Last update 6/16/2022.
