UPDATE to 5/31/2022 FLASH UPDATE: The Opatch micropatching service released an unofficial patch that mitigates a critical zero-day vulnerability known as “Follina” (tracked as CVE-2022-30190), which allows threat actors to weaponize Word documents to locally execute remotely hosted malicious PowerShell scripts, leading to arbitrary code execution (ACE), utilizing the privileges of the calling application. The flaw specifically impacts the URI protocol handler for the Microsoft Windows Support Diagnostic Tool (MSDT), and if exploited, could allow attackers to install malicious programs, and conduct a host of other malicious activity without user interaction. In a Twitter post, Opatch explained that their patch does not disable the MSDT URI protocol handler (like Microsoft’s manual mitigation technique), and instead sanitizes the missing user-provided path. Unfortunately, this type of URI protocol handler flaw is not exclusive to the MSDT, and shortly after the MSDT vulnerability was unofficially patched, security researcher and co-founder of Hacker House, Matthew Hickey tweeted a new proof-of-concept (PoC) exploit that was able to convert the existing MSDT vulnerability to exploit another zero-day flaw in the Windows Search URI protocol handler known as “search-ms”. The Windows Search function is integrated into all Explorer windows, and “enables users to quickly search for files and items by file name, properties, and full-text contents.” The search-ms URI protocol handler, much like the MSDT handler, allows for interacting with remote hosts, allowing Hickey to successfully exploit this weakness by combining a Microsoft Office OLEObject flaw with the search-ms URI protocol handler to open a remote search window by simply opening a Word document. The successful exploitation of this vulnerability would allow threat actors to socially engineer victims into conducting actions that automatically open search windows and launch malware locally. These fundamental vulnerabilities are much like the infamous Windows “PrintNightmare” Print Spooler flaws, where the privilege escalation and command execution vulnerabilities would be patched by Microsoft, but threat actors would quickly find new vulnerabilities due to the underlying weakness in the Print Spooler itself. In response to this threat, Microsoft will likely need to take steps to eliminate the opportunity for URI protocol handlers to be launched without any user interaction. To mitigate the search-ms flaw for the time-being, administrators can utilize the same type of manual mitigation techniques used for the MSDT vulnerability, by deleting the search-ms protocol handler from the Windows Registry. To download the free Opatch for the MSDT vulnerability, administrators should register an Opatch account, which will automatically install the patch locally once the Opatch agent is installed. The CTIX team will closely monitor the exploitation of this flaw, and updates may be released in future FLASH Updates.