⚡ TL;DR | Go Straight to the Microsoft Office Zero-Day Audit
Microsoft released a new security advisory detailing mitigation for CVE-2022-30190, a vulnerability in the Microsoft Support Diagnostic Tool. The vulnerability has a CVSS base score of 7.8. Microsoft summarizes the vulnerability as follows.
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user's rights.
The "Follina" vulnerability, as it has been dubbed, was disclosed late last week but exploitation has been around for much longer. The first time exploitation was detected dates back to April 12, 2022, when a sample was uploaded to the malware database for the second time.
Mitigation - Disable the MSDT URL Protocol
The official workaround is to disable the MSDT URL protocol. This prevents troubleshooters from being launched as links including links throughout the operating system.
Follow these steps to disable:
- Run Command Prompt as Administrator.
- To back up the registry key, execute the command "
reg export HKEY_CLASSES_ROOT\ms-msdt filename" - Execute the command "
reg delete HKEY_CLASSES_ROOT\ms-msdt /f".
How to undo the workaround
- Run Command Prompt as Administrator.
- To back up the registry key, execute the command "
reg import filename"
Discover Vulnerable Devices
Microsoft's security advisory contains the above-mentioned workaround. We've used this information to create a special Lansweeper report that will provide a list of all devices in your environment that are vulnerable based on whether the registry key is present or not.
