IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Fresh Microsoft Office zero-day executes code on fully patched applications

Malicious documents saved in Rich Text Format are especially concerning since they can execute code without even being opened

A magnifying glass hovering over a PC screen with the symbols for Microsoft Office software displayed

A new Microsoft Office zero-day vulnerability has been discovered by security researchers that leads to code execution.

The vulnerability involves exploiting maliciously crafted documents (maldocs) to load HTML code which then uses the ms-msdt Microsoft Office Uniform Resource Identifier (URI) scheme to execute PowerShell code.

Office URIs were introduced in Office 2010 Service Pack 2 and allow Office applications to be invoked using various commands.

Ms-msdt is a URI that invokes a troubleshooting pack at the command line or as part of an automated script and enables additional options without user input.

The exploit is an example of ways cyber attackers are bypassing Microsoft’s tougher rules on macro-enabled documents - a method of malware delivery previously very popular until Microsoft’s intervention earlier this year.

In testing the vulnerability, independent security researcher Kevin Beaumont noticed that Defender for Endpoint was not detecting the execution of the code embedded in the maldocs and that it would still work when Office macros were fully disabled.

Other researchers have spotted Defender for Endpoint and the free version of the anti-malware tool picking up the malicious sample, though.

Beaumont also noted the Office’s limited-functionality Protected View does initiate in the most up-to-date Office versions, requiring the user to click out of the safer mode for the document to execute.

However, if the maldoc is saved in a Rich Text Format (RTF), then the malicious code can run even if the document hasn’t been opened, via the Windows Explorer preview tab.

Beaumont said he was able to exploit the vulnerability in Office versions 2013 and 2016, and added that he was unable to reproduce the exploit on the current public and insider builds.

Other researchers have been able to test the vulnerability further, with one achieving a working exploit using Windows 11 and an April version of Office Pro Plus. Another was able to replicate it on a fully patched Microsoft Office 2021.

Despite it not currently believed to be affecting the most recent versions, Beaumont - a former Microsoft-employed cyber security expert - said the zero-day is still noteworthy given that many businesses run older channels of Office software.

“Detection is probably not going to be great, as Word loads the malicious code from a remote template (webserver), so nothing in the Word document is actually malicious,” he said.

“Microsoft are going to need to patch it across all the different product offerings, and security vendors will need robust detection and blocking. Microsoft will probably point towards Protected View, however, Protected View also applies by default to all macros, and Office macro malware is most definitely a major problem regardless.

“Additionally, you can use MS Protocol URI schemes in Outlook emails,” he added.

It’s currently unclear how Microsoft intends to respond to the discovery and how quickly a patch will be made available.

IT Pro contacted Microsoft for a response but it did not reply at the time of publication.

Featured Resources

ZTNA vs on-premises VPN

How ZTNA wins the network security game

Free Download

The global use of collaboration solutions in hybrid working environments

How companies manage security risks

Free Download

How to build a cyber-resilient business ready to innovate and thrive

Outperform your peers in your successful business outcomes

Free Download

Accelerating your IT transformation

How Cloudflare is innovating for CIOs to start 2023

Watch now

Most Popular

Tech pioneers call for six-month pause of "out-of-control" AI development
artificial intelligence (AI)

Tech pioneers call for six-month pause of "out-of-control" AI development

29 Mar 2023
Getting the best value from your remote support software
Advertisement Feature

Getting the best value from your remote support software

13 Mar 2023
Microsoft Security Copilot could be a seismic success for the tech industry

Microsoft Security Copilot could be a seismic success for the tech industry

29 Mar 2023