"Microsoft Confirms Exploitation of 'Follina' Zero-Day Vulnerability"

Microsoft has confirmed that Windows is affected by a zero-day vulnerability after researchers warned of exploitation in the wild. The vulnerability is now tracked as CVE-2022-30190. A researcher who uses the online moniker “nao_sec” recently reported finding a malicious Word file designed to execute arbitrary PowerShell code. The file was uploaded to VirusTotal from Belarus. Kevin Beaumont was among the first to analyze the exploit and decided to name it “Follina” because the malicious file references 0438, which is the area code for the Italian village of Follina. Since April, Microsoft had known about the vulnerability when it was notified by “CrazymanArmy” of the Shadow Chaser Group, a research team focusing on APT hunting and analysis. Microsoft initially classified the vulnerability as “not a security related issue,” despite the researcher informing the company in April that a sample exploiting it had been seen in the wild. Microsoft later informed the researcher that the “issue has been fixed,” but a patch does not appear to be available. Follina was initially described as a Microsoft Office zero-day vulnerability, but Microsoft says it actually affects the Microsoft Support Diagnostic Tool (MSDT), which collects information that is sent to Microsoft support. Microsoft explained that a remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, delete data, or create new accounts in the context allowed by the user’s rights. Microsoft noted that unlike other exploits involving documents, this attack does not rely on macros, and the malicious code is executed even if macros are disabled. Researchers stated that exploitation works against Office Pro Plus, Office 2013, Office 2016, Office 2019, and Office 2021. According to Microsoft, the vulnerability affects Windows 7, Windows 8.1, Windows 10, Windows 11, Windows Server 2008, Windows Server 2012, Windows Server 2016, Windows Server 2019, and Windows Server 2022. Microsoft has released guidance for this remote code execution vulnerability, including workarounds and information on new Defender updates designed to detect and block files and behavior associated with the threat.

SecurityWeek reports: "Microsoft Confirms Exploitation of 'Follina' Zero-Day Vulnerability"