D3: Microsoft MSHTML Remote Code Execution Vulnerability

EXECUTIVE SUMMARY

A new vulnerability in MSHTML (Part of MS Office) is being actively exploited by malicious actors. This can enable malware execution through the MSHTML “web engine” functionality present in Office applicatons. The simplicity of opening a specially crafted MS Office document makes it ideal bait for phishing and spearphishing attempts.

IMPACT

Once an emailed or shared Office document is opened by the user, the attacker could be able to execute malicious code with the permissions of the logged in user, potentially exposing the system and/or the entire network to a larger compromise.

DETAILED ANALYSIS

Though the MSHTML engine is not a browser by itself, this engine is capable of displaying HTML web content, which allows the misuse of the vulnerability described in CVE-2021-40444 to deliver and execute a malicious payload. Microsoft no longer recommends using Internet Explorer, the browser has been deprecated in modern versions of the Windows operating system for the new Microsoft Edge browser technology. Users should take care not to open unexpected files regardless, but vulnerable versions of the MSHTML web engine are still present in the Windows OS and Microsoft Office applications.

This exploit works like this:

1. User opens a malicious Microsoft Office document
2. The Microsoft Office Document contains embedded code that activates an ActiveX plugin in the Office application
3. The ActiveX control initiates an MSHTML engine and exploits a vulnerability giving the malware the same permissions as the logged in user which can be used to drop and execute additional malicious code.

This vulnerability can be exploited without any additional user input and is exploitable even when opening in “Protected View”. Dataprise recommends disabling ActiveX in Office altogether using the following process.

1. Click File > Options.
2. Click Trust Center > Trust Center Settings > ActiveX Settings.
3. Click the options you want, and then click OK.

The following is an example of the ActiveX Settings area of the Trust Center.

If you change an ActiveX setting in Word, Access, Excel, PowerPoint, Publisher, or Visio, the settings are changed in all those programs.

INDICATORS OF VULNERABILITY

Any machine running MS Windows and MS Office Package in any version.

MITIGATION STEPS

Microsoft’s official mitigation is to enforce network-wide settings to disable ActiveX on Internet Explorer (and related applications) – this can be achieved through registry changes and/or GPOs.
According to Microsoft: “This can be accomplished for all sites by updating the registry. Previously-installed ActiveX controls will continue to run, but do not expose this vulnerability.

SOURCES

• Windows zero-day MSHTML attack – how not to get booby trapped! – Naked Security (sophos.com)
• Microsoft, CISA Urge Mitigations for Zero-Day RCE Flaw in Windows | Threatpost
• Microsoft Releases Mitigations and Workarounds for CVE-2021-40444 | CISA
• CVE-2021-40444 – Security Update Guide – Microsoft – Microsoft MSHTML Remote Code Execution Vulnerability
• https://support.microsoft.com/en-us/office/enable-or-disable-activex-settings-in-office-files-f1303e08-a3f8-41c5-a17e-b0b8898743ed
  

CONTRIBUTING AUTHORS

• Stephen Jones, Senior Director Cybersecurity
• Sam Bourgeois, vCISO
• Maximo Bredfeldt, vCISO