CVE-2022-30190: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Overview

Severity: High (CVSS 7.8)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Category: Remote Code Execution
Exploit Status: Actively Exploited
Exploitation Likelihood: Detected
Publicly Disclosed: Yes
Patch Tuesday: 2022-May
Released: 2022-05-30
Last Updated: 2022-06-14
EPSS Score: 93.60% (percentile: 99.8%)
CISA KEV: Listed — due 2022-07-05

Description

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.

FAQ

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution? The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer. Is there an update available to address this vulnerability? Yes, the updates are available. Microsoft recommends installing the June updates as soon as possible. Where can I find more information? Please see this MSRC Blog Entry.

Known Exploits (25)

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2025-02-07T00:35:46Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2024-07-20T17:50:48Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2024-04-09T22:40:09Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2023-11-28T03:47:32Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2023-07-17T15:24:54Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2023-05-14T13:38:43Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2023-05-02T07:56:28Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2023-03-14T07:00:47Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2023-02-13T23:58:58Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2022-12-29T13:06:16Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2022-11-19T18:09:47Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2022-10-06T11:41:43Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2022-09-15T16:12:57Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2022-06-29T08:48:12Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2022-06-27T16:14:34Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2022-06-09T09:32:10Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2022-06-08T10:58:23Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2022-06-04T19:48:37Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2022-06-03T00:25:37Z
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability — added 2022-06-02T16:14:13Z

Detection & Weaponization (4 sources)

Maturity: Detection

Metasploit modules: Microsoft Office Word MSDTJS
Sigma rules: Suspicious Set Value of MSDT in Registry (CVE-2022-30190)
YARA rules: SIGNATURE_BASE_SUSP_PS1_Msdt_Execution_May22, SIGNATURE_BASE_SUSP_Doc_Wordxmlrels_May22, SIGNATURE_BASE_SUSP_Doc_RTF_Externalresource_May22, SIGNATURE_BASE_EXPL_Follina_CVE_2022_30190_Msdt_Msprotocoluri_May22, SIGNATURE_BASE_SUSP_DOC_RTF_Externalresource_EMAIL_Jun22, SIGNATURE_BASE_SUSP_Msdt_Artefact_Jun22_2, SIGNATURE_BASE_SUSP_LNK_Follina_Jun22
GitHub PoC: 91 repositories

Affected Products (35)

Windows

Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows Server 2022
Windows Server 2022 (Server Core installation)
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows Server, version 20H2 (Server Core Installation)
Windows 11 version 21H2 for x64-based Systems
Windows 11 version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows Server 2016
Windows Server 2016 (Server Core installation)
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows RT 8.1

ESU

Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2012
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)

Security Updates (12)

Acknowledgments

<a href="https://twitter.com/crazymanarmy">crazyman</a> with <a href="https://twitter.com/shadowchasing1">Shadow Chaser Group</a>

Revision History

2022-05-30: Information published.
2022-06-03: Added an FAQ. This is an information change only.
2022-06-14: The update for this vulnerability is in the June 2022 cumulative Windows Updates. Microsoft strongly recommends that customers install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.