Researchers Spot New Microsoft Office Zero-Day Exploit in the Wild

Microsoft has confirmed a zero-day flaw in its Office Software that could be abused to achieve arbitrary code execution on affected Windows systems. The vulnerability has been tracked as CVE-2022-30190, with a CVSS severity score of 7.8 out of 10.

The vulnerability uses Word’s external link to load a HTML file and then exploits the Microsoft Support Diagnostics Tool to allow attackers to execute PowerShell code remotely on compromised devices.

The shortcoming came to light after an independent cybersecurity research team known as nao_sec uncovered a Word document (“05-2022-0438.doc“) that was uploaded to VirusTotal from an IP address in Belarus.

In a standalone analysis, cybersecurity company Huntress Labs detailed the attack flow, noting the HTML file that triggers the exploit originated from a now-unreachable domain named “Xmlformats[.]com.” “A Rich Text Format file could trigger the invocation of this exploit with just the Preview Pane within Windows Explorer,” Huntress Labs’ John Hammond said.

“Much like CVE-2021-40444, this extends the severity of this threat by not just ‘single-click’ to exploit, but potentially with a ‘zero-click’ trigger.”

Multiple Microsoft Office versions, including Office, Office 2016, and Office 2021, are said to be affected, although other versions are expected to be vulnerable as well.

If you need assistance defending your system or wish to learn more about this incident, fill out the button below to speak to one of our cyber security consultants today.

Contact

Cloud security is a fundamentally new landscape for many companies. While many security principles remain the same as on-premises, the implementation is often very different. This overview provides a snapshot of five best practices for cloud security: identity and access management, security posture management, apps and data security, threat protection and network security.

1. Strengthen access control

Traditional security measures are not enough to defend against modern security attacks. Today’s best practice is to ‘assume breach’ and protect as though the attacker has breached the network perimeter. A Zero Trust approach that verifies and secures every identity, validates device health, enforces least-privilege access and captures and analyses telemetry is therefore a new security mandate.

• Enforce Conditional Access policies
• Institute multi-factor authentication
• Ensure least privilege access

2. Improve your security posture

With the dynamic nature of the cloud and ever-growing landscape of workloads and other resources, it can be difficult to understand your company’s security state in the cloud. Make sure you have the tools you need to assess your current environments, identify risks and mitigate them.

• Access and strengthen your current posture
• Educate stakeholders
• Collaborate with your DevOps team on policies

3. Secure apps and data

Protect data, apps and infrastructure through a layered, defence-in-depth strategy across identity, data, hosts and networks.

• Encryption
• Follow security best practices
• Share the responsibility

4. Defend against threats

Operational security posture – protect, detect and respond – should be informed by security intelligence to identify rapidly evolving threats early so you can respond quickly.

• Enable detection for all resource types
• Integrate threat intelligence
• Modernise your security information and event management (SIEM)

5. Protect the network

The network security landscape is rapidly transforming. To keep pace with the changes, your security solutions must meet the challenges of the evolving threat landscape and make it more difficult for attackers to exploit networks.

• Keep strong firewall protection
• Enable distributed denial-of-service
• Create a micro-segmented network

Are you looking to strengthen the security of your cloud workloads? Contact us today.

Contact