Follina Vulnerability

Product Serial: F-2022-06-01a

TLP: WHITE

In this report, ZeroFox Intelligence provides a brief look at CVE-2022-30190, a vulnerability in the Microsoft Support Diagnostic Tool (MSDT) protocol handler.

Standing Intelligence Requirements

DDW VULN

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full brief here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on June 1, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

On May 27, 2022, security researcher “nao_sec” shared a malicious Word document that had been discovered taking advantage of Windows’ Microsoft Support Diagnostic Tool (MSDT). The document abused Microsoft Word’s ability to load remote document templates to retrieve a HTML file from a web server. The retrieved HTML document contained embedded JavaScript to trigger ms-msdt protocol via a window.location.href reference to execute a PowerShell script. PowerShell is a cross-platform command line interpreter and scripting language created by Microsoft that is installed by default in Windows. This vulnerability, dubbed “Follina,” has been used in the wild. For example, a known Chinese APT, TA413, has been observed exploiting Follina while impersonating the “Women Empowerments Desk” of the Central Tibetan Administration.