IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Fresh Microsoft Office zero-day executes code on fully patched applications

Malicious documents saved in Rich Text Format are especially concerning since they can execute code without even being opened

A magnifying glass hovering over a PC screen with the symbols for Microsoft Office software displayed

A new Microsoft Office zero-day vulnerability has been discovered by security researchers that leads to code execution.

The vulnerability involves exploiting maliciously crafted documents (maldocs) to load HTML code which then uses the ms-msdt Microsoft Office Uniform Resource Identifier (URI) scheme to execute PowerShell code.

Office URIs were introduced in Office 2010 Service Pack 2 and allow Office applications to be invoked using various commands.

Ms-msdt is a URI that invokes a troubleshooting pack at the command line or as part of an automated script and enables additional options without user input.

The exploit is an example of ways cyber attackers are bypassing Microsoft’s tougher rules on macro-enabled documents - a method of malware delivery previously very popular until Microsoft’s intervention earlier this year.

In testing the vulnerability, independent security researcher Kevin Beaumont noticed that Defender for Endpoint was not detecting the execution of the code embedded in the maldocs and that it would still work when Office macros were fully disabled.

Other researchers have spotted Defender for Endpoint and the free version of the anti-malware tool picking up the malicious sample, though.

Beaumont also noted the Office’s limited-functionality Protected View does initiate in the most up-to-date Office versions, requiring the user to click out of the safer mode for the document to execute.

However, if the maldoc is saved in a Rich Text Format (RTF), then the malicious code can run even if the document hasn’t been opened, via the Windows Explorer preview tab.

Beaumont said he was able to exploit the vulnerability in Office versions 2013 and 2016, and added that he was unable to reproduce the exploit on the current public and insider builds.

Other researchers have been able to test the vulnerability further, with one achieving a working exploit using Windows 11 and an April version of Office Pro Plus. Another was able to replicate it on a fully patched Microsoft Office 2021.

Despite it not currently believed to be affecting the most recent versions, Beaumont - a former Microsoft-employed cyber security expert - said the zero-day is still noteworthy given that many businesses run older channels of Office software.

“Detection is probably not going to be great, as Word loads the malicious code from a remote template (webserver), so nothing in the Word document is actually malicious,” he said.

“Microsoft are going to need to patch it across all the different product offerings, and security vendors will need robust detection and blocking. Microsoft will probably point towards Protected View, however, Protected View also applies by default to all macros, and Office macro malware is most definitely a major problem regardless.

“Additionally, you can use MS Protocol URI schemes in Outlook emails,” he added.

It’s currently unclear how Microsoft intends to respond to the discovery and how quickly a patch will be made available.

IT Pro contacted Microsoft for a response but it did not reply at the time of publication.

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

Kaspersky exposes MysterySnail zero-day exploit in Windows
zero-day exploit

Kaspersky exposes MysterySnail zero-day exploit in Windows

13 Oct 2021

Most Popular

Salaries for the least popular programming languages surge as much as 44%
Development

Salaries for the least popular programming languages surge as much as 44%

23 Jun 2022
The top programming languages you need to learn for 2022
Careers & training

The top programming languages you need to learn for 2022

23 Jun 2022
Swift exit: How the world cut off Russian banks
finance

Swift exit: How the world cut off Russian banks

24 Jun 2022