Skip to content

Defense Digests

D3: Microsoft MSHTML Remote Code Execution Vulnerability

Dataprise Defense Digest 550x550

Table of content

EXECUTIVE SUMMARY

A new vulnerability in MSHTML (Part of MS Office) is being actively exploited by malicious actors. This can enable malware execution through the MSHTML “web engine” functionality present in Office applicatons. The simplicity of opening a specially crafted MS Office document makes it ideal bait for phishing and spearphishing attempts.

IMPACT

Once an emailed or shared Office document is opened by the user, the attacker could be able to execute malicious code with the permissions of the logged in user, potentially exposing the system and/or the entire network to a larger compromise.

DETAILED ANALYSIS

Though the MSHTML engine is not a browser by itself, this engine is capable of displaying HTML web content, which allows the misuse of the vulnerability described in CVE-2021-40444 to deliver and execute a malicious payload. Microsoft no longer recommends using Internet Explorer, the browser has been deprecated in modern versions of the Windows operating system for the new Microsoft Edge browser technology. Users should take care not to open unexpected files regardless, but vulnerable versions of the MSHTML web engine are still present in the Windows OS and Microsoft Office applications.

This exploit works like this:

  1. User opens a malicious Microsoft Office document
  2. The Microsoft Office Document contains embedded code that activates an ActiveX plugin in the Office application
  3. The ActiveX control initiates an MSHTML engine and exploits a vulnerability giving the malware the same permissions as the logged in user which can be used to drop and execute additional malicious code.

This vulnerability can be exploited without any additional user input and is exploitable even when opening in “Protected View”. Dataprise recommends disabling ActiveX in Office altogether using the following process.

  1. Click File > Options.
  2. Click Trust Center > Trust Center Settings > ActiveX Settings.
  3. Click the options you want, and then click OK.

The following is an example of the ActiveX Settings area of the Trust Center.

 

If you change an ActiveX setting in Word, Access, Excel, PowerPoint, Publisher, or Visio, the settings are changed in all those programs.

INDICATORS OF VULNERABILITY

Any machine running MS Windows and MS Office Package in any version.

MITIGATION STEPS

Microsoft’s official mitigation is to enforce network-wide settings to disable ActiveX on Internet Explorer (and related applications) – this can be achieved through registry changes and/or GPOs.
According to Microsoft: “This can be accomplished for all sites by updating the registry. Previously-installed ActiveX controls will continue to run, but do not expose this vulnerability.

SOURCES

CONTRIBUTING AUTHORS

  • Stephen Jones, Senior Director Cybersecurity
  • Sam Bourgeois, vCISO
  • Maximo Bredfeldt, vCISO

Recent Tweets

INSIGHTS

Learn about the latest threats and vulnerabilities with our D3 alerts.

Subscribe to get real-time notifications when a new Dataprise Defense Digest is published.