Fresh Microsoft Office zero-day executes code on fully patched applications

A magnifying glass hovering over a PC screen with the symbols for Microsoft Office software displayed

A new Microsoft Office zero-day vulnerability has been discovered by security researchers that leads to code execution.

The vulnerability involves exploiting maliciously crafted documents (maldocs) to load HTML code which then uses the ms-msdt Microsoft Office Uniform Resource Identifier (URI) scheme to execute PowerShell code.

Office URIs were introduced in Office 2010 Service Pack 2 and allow Office applications to be invoked using various commands.

Ms-msdt is a URI that invokes a troubleshooting pack at the command line or as part of an automated script and enables additional options without user input.

The exploit is an example of ways cyber attackers are bypassing Microsoft’s tougher rules on macro-enabled documents - a method of malware delivery previously very popular until Microsoft’s intervention earlier this year.

In testing the vulnerability, independent security researcher Kevin Beaumont noticed that Defender for Endpoint was not detecting the execution of the code embedded in the maldocs and that it would still work when Office macros were fully disabled.

Other researchers have spotted Defender for Endpoint and the free version of the anti-malware tool picking up the malicious sample, though.

Beaumont also noted the Office’s limited-functionality Protected View does initiate in the most up-to-date Office versions, requiring the user to click out of the safer mode for the document to execute.

However, if the maldoc is saved in a Rich Text Format (RTF), then the malicious code can run even if the document hasn’t been opened, via the Windows Explorer preview tab.

Beaumont said he was able to exploit the vulnerability in Office versions 2013 and 2016, and added that he was unable to reproduce the exploit on the current public and insider builds.

Other researchers have been able to test the vulnerability further, with one achieving a working exploit using Windows 11 and an April version of Office Pro Plus. Another was able to replicate it on a fully patched Microsoft Office 2021.

Despite it not currently believed to be affecting the most recent versions, Beaumont - a former Microsoft-employed cyber security expert - said the zero-day is still noteworthy given that many businesses run older channels of Office software.

“Detection is probably not going to be great, as Word loads the malicious code from a remote template (webserver), so nothing in the Word document is actually malicious,” he said.

“Microsoft are going to need to patch it across all the different product offerings, and security vendors will need robust detection and blocking. Microsoft will probably point towards Protected View, however, Protected View also applies by default to all macros, and Office macro malware is most definitely a major problem regardless.

“Additionally, you can use MS Protocol URI schemes in Outlook emails,” he added.

It’s currently unclear how Microsoft intends to respond to the discovery and how quickly a patch will be made available.

IT Pro contacted Microsoft for a response but it did not reply at the time of publication.

Connor Jones
Contributor

Connor Jones has been at the forefront of global cyber security news coverage for the past few years, breaking developments on major stories such as LockBit’s ransomware attack on Royal Mail International, and many others. He has also made sporadic appearances on the ITPro Podcast discussing topics from home desk setups all the way to hacking systems using prosthetic limbs. He has a master’s degree in Magazine Journalism from the University of Sheffield, and has previously written for the likes of Red Bull Esports and UNILAD tech during his career that started in 2015.