A critical Microsoft zero-day vulnerability was mitigated over the Memorial Day 2022 weekend. The flaw, tracked as CVE-2022-30190 (aka “Follina”), was reported by “crazyman” of Shadow Chaser Group, a sub-group of GcowSec that focuses specifically on APT hunts and analysis. The vulnerability affects the Microsoft Windows Support Diagnostic Tool (MSDT) and occurs when the MSDT is called via the URL protocol from an application such as Microsoft Word. For the successful exploitation of Follina, simply opening the malicious Word document executes PowerShell commands locally, leading to arbitrary code execution (ACE), utilizing the privileges of the calling application. Once exploited, attackers can perform malicious actions such as installing malware, viewing and changing data, creating new privileged user accounts, and creating malicious child processes. The Follina zero-day poses an unprecedented risk to Microsoft Office products due to it functioning without having to secure elevated privileges, as well as not having to have embedded macro code that executes the malicious scripts and files. This allows the exploit to bypass Windows Defender’s detection because the malicious code loads remotely and the malicious Word document doesn’t get flagged as a threat because there are no embedded macros or scripts, just references to them. Multiple security researchers have analyzed the vulnerability and produced working Proof-of-Concept (PoC) exploits that apply to multiple versions of Microsoft Office. If left unmitigated, attackers can leverage this vulnerability to spread laterally across the victim network, as well as collect hashes of Windows passwords allowing for follow-on malicious activity. This bug was first reported to Microsoft in April 2022; however, Microsoft closed it as “fixed” due to being unable to replicate the exploit. Now that there are working PoCs, CTIX analysts predict that Microsoft will release an emergency patch in the near future. Until then, the company has published a mitigation technique to disable the MSDT URL protocol via Command Prompt as Administrator. Additional details can be found in the guidance provided by the Microsoft Security Response Center (MSRC) advisory linked below.