Security vulnerability in Follina exploit

Preventing exploitation of the Follina vulnerability in MSDT

Adam King

8th June 2022

4 min read

This article provides a synopsis of the Follina exploit and simple steps you can take to mitigate this severe remote code execution vulnerability within Microsoft Support Diagnostic Tool (MSDT). This vulnerability is triggered via common Windows applications such as Microsoft Word and is being actively exploited by known hacking groups.

The Follina Exploit

A zero-click Remote Code Execution (RCE) vulnerability has started making the rounds which is leveraging functionality within applications such as Microsoft Word. This vulnerability exists when the application calls MSDT using the URL protocol and allows remote attackers to execute PowerShell code on the victim’s device, under the context of the application user. In addition to this, the exploit can be triggered whilst previewing the document only. The exploit has been dubbed “Follina” and is registered as CVE-2022-30190.

Due to the nature of the exploit and how it is triggered, it is expected that an increased amount of exploitation attempts in the wild will be made via threat actors sending malicious files via phishing. You can read more about phishing attacks and how to protect against them in this blog post.

Severity and Proof of Concept

The exploit has been given a CVSSv3 rating of 7.8. The vulnerability was originally reported by crazyman of the Shadow Chaser Group and impacts all Windows versions still receiving security updates (Windows 7+ and Windows Server 2008+). Proof-of-Concept (PoC) exploit code has been released publicly, with a module being released in the popular exploit framework Metasploit.

Official Patch Status

Microsoft have yet to release an update at the time of writing (08/06/2022) to patch this vulnerability, however they have released guidance for mitigating the issue on their Microsoft Security Response Center (MSRC) blog to reduce the attack surface. It is highly recommended that this workaround is applied until an official patch is released by Microsoft.

Mitigation and Workaround Steps

As described by Microsoft, the following actions must be taken to perform the workaround.

Run Command Prompt as Administrator.
To back up the registry key, execute the command “reg export HKEY_CLASSES_ROOT\ms-msdt filename“
Execute the command “reg delete HKEY_CLASSES_ROOT\ms-msdt /f”.

 

To undo, simply import the backup of the registry key.

Run Command Prompt as Administrator.
To restore the registry key, execute the command “reg import filename”

 

The MSRC also details how Microsoft Defender solutions can detect and alert on potential exploit activity.

Whilst the remediation steps appear to have no adverse impact on a system during our testing, it should be noted that any modification of the registry can cause unwanted behaviours in Windows operating systems and should be tested thoroughly.

We have created a PowerShell script that will backup the targeted registry key before removing it, automating the workaround steps highlighted above. You can find this script on our public GitHub.  This script may be deployed through Microsoft InTune and other MDM solutions to patch multiple vulnerable systems.

 

Resources

  • Insights
  • Labs
ISO 9001 and ISO 27001

Sentrium Achieves ISO 9001 and ISO 27001 Certifications

In an increasingly digital world, the importance of quality and security cannot be overstated. Sentrium Security Ltd is excited to share our recent achievement –…

What are the different types of penetration testing?

What are the different types of penetration testing?

As digital business becomes more widespread, the need to ensure data security increases. One way to test its effectiveness is through penetration testing. Penetration tests…

OWASP Global Image

OWASP Top 10 2021 Released

The Open Web Application Security Project (OWASP) is a not-for-profit organisation that aims, through community-led open-source projects, to improve the security of web-based software. OWASP…

Using a CREST-Approved penetration testing provider

What is CREST penetration testing and why is it important to use a CREST-approved provider?

Trusting the effectiveness of your IT security controls is crucial to mitigate risks and malicious access to your systems and the information they store. Penetration…

cloud computing technology concept transfer database to cloud. T

How secure use of the cloud can digitally transform your business

Companies that move towards digital transformation can innovate more quickly, scale efficiently and reduce risk by implementing cloud security best practices. Businesses must keep up…

How to prepare your business for secure cloud migration

How to prepare your business for secure cloud migration

The cloud holds a lot of potential for organisations. Moving your IT environment to a secure cloud provides flexibility and agility. It allows your team…

Application Security 101 – HTTP headers

Application Security 101 – HTTP Headers Information Disclosure

Server Header Information Disclosure The most common HTTP header that is enabled by default in most web servers is the ‘Server’ header, which can lead…

SPF, DKIM, DMARC and BIMI for Email Security

SPF, DKIM, DMARC and BIMI for Email Security

Sender Policy Framework Sender Policy Framework (SPF) is a DNS TXT record that is added to a domain that tells email recipients which IP addresses…

Terraform security best practices

Terraform security best practices (2022)

The following sections discuss our most important Terraform security best practices: The importance of Terraform State Terraform must keep track of the resources created. When…

Application Security 101 – HTTP headers

Application Security 101 – HTTP headers

1. Strict-Transport-Security The HTTP Strict Transport Security (HSTS) header forces browsers and other agents to interact with web servers over the encrypted HTTPS protocol, which…

Code, HTML, php web programming source code. Abstract code background - 3d rendering

New Exchange RCE vulnerability actively exploited

Exchange admins now have another exploit to deal with despite still reeling from a number of high profile attacks this year including ProxyLogon and ProxyShell.…