New Method of Achieving Code Execution in Microsoft Excel

Dynamic Data Exchange, or DDE, attacks have remained popular since their initial disclosure in October 2017. A new method of using DDE objects to load external objects without user interaction has been discovered by researchers at Mimecase. This method, which involves abusing the Power Query feature, could potentially be used to drop secondary malware or execute arbitrary commands on a victim machine. No patch is available, however, Microsoft has released mitigation guidelines.

Recommendations

• Consider enabling the cyber chatter rule to monitor activity related to this vulnerability.
• Apply the mitigation techniques recommended by Microsoft for this and other DDE related vulnerabilities.

Details

Researchers at Mimecast have discovered a new method for embedding remote payloads in Microsoft Excel documents. This method exploits a Dynamic Data Exchange (DDE) feature called Power Query, in order to load externally hosted malicious content with an Excel document. DDE was initially intended to exchange data between operating systems and applications, however, attackers often abuse it as a way to achieve macro-less code execution within a malicious Office file. This new version of the exploit could potentially be used to drop additional malware on a victim device, or even to fingerprint a device or sandbox. These researchers have released a proof of concept and further technical details in their blog post. Although Mimecast coordinated disclosure with Microsoft, Microsoft has declined to release a fix for this issue, and instead recommends their mitigation techniques for DDE related attacks be applied.