Cyber Defense eMagazine July Edition for 2022

Microsoft Support Diagnostic Tool Vulnerability: What to
Learn from It and How to Stay Safe
By Dirk Schrader, Resident CISO (EMEA) and VP of Security Research, Netwrix
A new vulnerability in the Microsoft Office universe has been recently discovered. Let’s examine some
details about it. How Microsoft Support Diagnostic Tool (MSDT) and other tools can be turned against
organizations? What IT teams can do to prevent something bad from happening?
What is going on?
Freshly discovered CVE-2022-30190 vulnerability in MS Office provides attackers with a new way of
hijacking organizations’ IT environments through endpoints. This exploit is likely to work on most
Windows / MS Office installations, if they aren’t patched yet.
The attacker crafts a MS Word document that contains the malware code, sends it to someone’s business
email address and uses common social engineering techniques to lure the recipient into opening it.
Remember Log4Shell vulnerability discovered in December 2021, where the issue was about an
uncontrolled way of executing a function in a function combined with the ability to call for external
resources. This 0-day, initially named ‘Follina’, works in a similar way.
Word has a feature called ‘remote template’ which is misused to get a HTML file from a distant location.
Once received, this HTML file uses a functionality in MSDT to execute an embedded payload, using
Powershell script or other tools available on the target.
Windows built-in security tools are likely not to catch this activity.Standard hardening benchmarks don’t
cover it either. Built-in defensive mechanism like Defender or common restrictions for the use of macros
will not block this attack as well.
Cyber Defense eMagazine – July 2022 Edition 102
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.