[Zher0]

CVE-2022-30190 aka "Follina" is likely to explode soon.

- uses Microsoft Diagnostic Tool (MSDT) to remotely access the payload
- does not require any privileges to execute
- works with the latest patched Office 2021
- is able to run via the RTF file format without opening the file (via windows file preview).

Full writeup: https://zerosecurity.org/2022/05/microso...powershell

[blackrose_x0x0]

Thanks for sharing. Pretty interesting vulnerability.

John Hammond also did a pretty great video on this as well that's worth checking out for those that are interested.





https://github.com/JohnHammond/msdt-follina

[Zher0]

Thanks for sharing. Pretty interesting vulnerability.

John Hammond also did a pretty great video on this as well that's worth checking out for those that are interested.





https://github.com/JohnHammond/msdt-follina

Woah, thanks for the Github link

[Bastille]

Heard about Follina few days ago, fortunately it seems that Windows Defender is able to block the payloads based on known signatures, and behavior based when cloud-delivered protection & submission is enabled.

Here is another way to block the attack :

- Disable URL MSDT protocole by deleting the register key in HKEY_CLASSES_ROOT\ms-msdt (could be done through a GPO in organization I guess)

Besides, it seems that some AV are also able to block this exploit like Bitdefender, nothing mentioned by Kaspersky tho

Glade to see some guys in this section 😉

[User_Ford]

Very informative,, thànk you