A newly discovered Microsoft zero-day vulnerability in its Office productivity suite could be exploited to deliver remote code execution on vulnerable systems.
Microsoft issued CVE-2022-30190 guidance regarding the Microsoft Support Diagnostic Tool (MSDT) in Windows vulnerability.
According to the CVSS vulnerability scoring system, the weakness is rated 7.8 out of 10 for severity. The affected versions of Microsoft Office include Office 2013, Office 2016, Office 2019, and Office 2021, as well as Professional Plus editions.
A security researcher shared screenshots of the vulnerability submission report with Microsoft on April 21, 2022, announcing that the issue had been fixed and dismissing the vulnerability as “not a security issue” since it required the passkey provided by a technician to run the diagnostic tool.
A remote code execution vulnerability existed when MSDT called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The cyber attacker can then install programs, view, change, delete data, or create new accounts in the context allowed by the user’s rights.
CVE-2022-30190 Impact
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights.
To disable the MSDT URL Protocol
Disabling MSDT URL protocol prevents troubleshooters being launched as links including links throughout the operating system.
Follow these steps to disable:
- Run Command Prompt as Administrator.
- To back up the registry key, execute the command “reg export HKEY_CLASSES_ROOT\ms-msdt filename“
- Execute the command “reg delete HKEY_CLASSES_ROOT\ms-msdt /f”.
How to undo the workaround
- Run Command Prompt as Administrator.
- To back up the registry key, execute the command “reg import filename.”
Microsoft Defender for Endpoint provides customers with detections and alerts. The following alert title in the Microsoft 365 Defender portal can indicate threat activity on your network:
- Suspicious behavior by an Office application
- Suspicious behavior by Msdt.exe
