The Most Recent Dataprise News and Awards

MSP Cloud Verify logo Inc.5000 logo CRAINS Best Places to Work in NYC logo
Dataprise Completes MSP Verify Certification with SOC 2 Type 2 Audit Computerworld Best Places to Work logo MSP 501 Winner logo CRN MSP 500 logoCRN MSP 500 logo
Tech Elite 250 logo MSP Cloud Verify logo Inc.5000 logo
CRN MSP 500 logo Dataprise Completes MSP Verify Certification with SOC 2 Type 2 Audit Computerworld Best Places to Work logo CRAINS Best Places to Work in NYC logo MSP 501 Winner logo

Global Service Alert

Published: 09/10/2021 09:26 EST

D3: Microsoft MSHTML Remote Code Execution Vulnerability

EXECUTIVE SUMMARY

A new vulnerability in MSHTML (Part of MS Office) is being actively exploited by malicious actors. This can enable malware execution through the MSHTML “web engine” functionality present in Office applicatons. The simplicity of opening a specially crafted MS Office document makes it ideal bait for phishing and spearphishing attempts.


IMPACT


Once an emailed or shared Office document is opened by the user, the attacker could be able to execute malicious code with the permissions of the logged in user, potentially exposing the system and/or the entire network to a larger compromise.


DETAILED ANALYSIS


Though the MSHTML engine is not a browser by itself, this engine is capable of displaying HTML web content, which allows the misuse of the vulnerability described in CVE-2021-40444 to deliver and execute a malicious payload. Microsoft no longer recommends using Internet Explorer, the browser has been deprecated in modern versions of the Windows operating system for the new Microsoft Edge browser technology. Users should take care not to open unexpected files regardless, but vulnerable versions of the MSHTML web engine are still present in the Windows OS and Microsoft Office applications.

This exploit works like this:

  1. User opens a malicious Microsoft Office document
  2. The Microsoft Office Document contains embedded code that activates an ActiveX plugin in the Office application
  3. The ActiveX control initiates an MSHTML engine and exploits a vulnerability giving the malware the same permissions as the logged in user which can be used to drop and execute additional malicious code.


This vulnerability can be exploited without any additional user input and is exploitable even when opening in “Protected View”. Dataprise recommends disabling ActiveX in Office altogether using the following process.

  1. Click File > Options.
  2. Click Trust Center > Trust Center Settings > ActiveX Settings.
  3. Click the options you want, and then click OK.

The following is an example of the ActiveX Settings area of the Trust Center.

EXECUTIVE SUMMARY

 

A new vulnerability in MSHTML (Part of MS Office) is being actively exploited by malicious actors. This can enable malware execution through the MSHTML “web engine” functionality present in Office applicatons. The simplicity of opening a specially crafted MS Office document makes it ideal bait for phishing and spearphishing attempts.


IMPACT


Once an emailed or shared Office document is opened by the user, the attacker could be able to execute malicious code with the permissions of the logged in user, potentially exposing the system and/or the entire network to a larger compromise.


DETAILED ANALYSIS


Though the MSHTML engine is not a browser by itself, this engine is capable of displaying HTML web content, which allows the misuse of the vulnerability described in CVE-2021-40444 to deliver and execute a malicious payload. Microsoft no longer recommends using Internet Explorer, the browser has been deprecated in modern versions of the Windows operating system for the new Microsoft Edge browser technology. Users should take care not to open unexpected files regardless, but vulnerable versions of the MSHTML web engine are still present in the Windows OS and Microsoft Office applications.

 

This exploit works like this:

 

  1. User opens a malicious Microsoft Office document
  2. The Microsoft Office Document contains embedded code that activates an ActiveX plugin in the Office application
  3. The ActiveX control initiates an MSHTML engine and exploits a vulnerability giving the malware the same permissions as the logged in user which can be used to drop and execute additional malicious code.


This vulnerability can be exploited without any additional user input and is exploitable even when opening in “Protected View”. Dataprise recommends disabling ActiveX in Office altogether using the following process.

  1. Click File > Options.
  2. Click Trust Center > Trust Center Settings > ActiveX Settings.
  3. Click the options you want, and then click OK.

The following is an example of the ActiveX Settings area of the Trust Center.

 

If you change an ActiveX setting in Word, Access, Excel, PowerPoint, Publisher, or Visio, the settings are changed in all those programs.

 

INDICATORS OF VULNERABILITY

Any machine running MS Windows and MS Office Package in any version.

MITIGATION STEPS

Microsoft’s official mitigation is to enforce network-wide settings to disable ActiveX on Internet Explorer (and related applications) - this can be achieved through registry changes and/or GPOs.
According to Microsoft: “This can be accomplished for all sites by updating the registry. Previously-installed ActiveX controls will continue to run, but do not expose this vulnerability.


SOURCES

CONTRIBUTING AUTHORS

  • Stephen Jones, Senior Director Cybersecurity
  • Sam Bourgeois, vCISO
  • Maximo Bredfeldt, vCISO

 

 

If you change an ActiveX setting in Word, Access, Excel, PowerPoint, Publisher, or Visio, the settings are changed in all those programs.

 

INDICATORS OF VULNERABILITY


Any machine running MS Windows and MS Office Package in any version.

 

MITIGATION STEPS

 

Microsoft’s official mitigation is to enforce network-wide settings to disable ActiveX on Internet Explorer (and related applications) - this can be achieved through registry changes and/or GPOs.
According to Microsoft: “This can be accomplished for all sites by updating the registry. Previously-installed ActiveX controls will continue to run, but do not expose this vulnerability.”


 

 

 

 


SOURCES

 

 

 

CONTRIBUTING AUTHORS

 

  • Stephen Jones, Senior Director Cybersecurity
  • Sam Bourgeois, vCISO
  • Maximo Bredfeldt, vCISO


View all active Global Service Alerts











Contact Us To Get Started Winning With IT Today!

If your business is looking to partner with a local IT support company that will learn the intimate details of your business technology and process, while also having the experience to manage and advise you on your day-to-day technology challenges, just fill out our contact form below and one of our consultants will contact you shortly.

  You have 2000 characters left.
*are required fields