*Introduction *
CVE-2022-30190, widely known as "Follina", is a remote code execution (RCE) vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT). It was brought to public attention on 27 May 2022, when the security research group nao_sec shared a malicious Word document sample publicly. Security researcher Kevin Beaumont named it "Follina" because the sample referenced 0438, the area code of Follina, a town in Italy.
The vulnerability allowed attackers to run code on a victim's machine simply by getting them to open a Word document. In some cases, previewing the file in Windows Explorer was enough. Most importantly, the attack worked even when macros were disabled, which made traditional Office security advice ineffective.
Here is a quick summary of the vulnerability:
OVERVIEW OF MSDT
The Microsoft Support Diagnostic Tool (MSDT) is a built-in Windows utility. It collects diagnostic information and runs troubleshooters when a user faces a problem with their system or an application. The collected data can then be sent to Microsoft support for analysis.
MSDT can be launched through a special URL protocol handler called ms-msdt. This means other applications can open MSDT by calling a link that starts with ms-msdt, in the same way a browser opens a website with an https link. This convenient feature is exactly what Follina abused.
THE REMOTE TEMPLATE FEATURE
Microsoft Office supports a feature that lets a document load content from an external source, such as a template stored on a remote server. When a document is opened, Office reads its internal relationship files and fetches any resource that is marked as external.
Office documents like .docx are actually ZIP archives that contain many XML files. One of these files lists the resources that the document depends on. Each resource is described by a relationship entry, and a normal entry points to a local file kept inside the document itself.
**
FOLLINA**
In the malicious sample, one of the relationship entries did not point to a local file. Instead, it pointed to a remote address and was flagged as an external target. That flag tells Word to reach out to the internet and fetch the resource when the document opens. Because the attacker controls the server at that address, they also control the content that Word downloads. This is where the real attack begins.
DEEP DIVE ON OCCURRENCE OF FOLLINA
The remote file that Word downloaded was an HTML page, and it contained two important parts.
The first part was a large block of filler text. At first this looked like meaningless junk. Researchers later found that its only purpose was to make the file large enough. Below a certain size the browser engine used by Office would ignore the script, so the attacker padded the file to push it past that limit.
The second part was a small piece of script. This script invoked the ms-msdt protocol handler and passed it a set of arguments. Those arguments were crafted so that MSDT, instead of running a normal troubleshooter, ended up handing an attacker-supplied command to PowerShell. The command in the public sample was hidden with Base64 encoding, and once decoded it fetched a further payload, decoded it, and ran it on the machine.
THE VULNERABILITY
The root of the problem was that MSDT accepted and processed attacker-controlled input from a document without proper validation. A feature meant for diagnostics became a bridge from a Word document straight to code execution.
The full attack chain looked like this:
AFFECTED PRODUCTS
Follina affected a wide range of Microsoft Office versions running on Windows.
ATTACKS IN THE WILD
Follina was not just a proof of concept. It was used in real attacks both before and after public disclosure.
MITIGATION
Before the official patch, Microsoft advised disabling the ms-msdt URL protocol handler as a temporary workaround. The permanent fix arrived on 14 June 2022. The vulnerability was also added to the CISA Known Exploited Vulnerabilities catalog, and several security vendors offered their customers temporary protection ahead of the patch.
Some general lessons for defenders:
Patch quickly and track advisories such as the CISA KEV catalog.
Treat researcher reports seriously. A ticket closed in April became a global zero-day in May.
Use behavioral detection. Watch for Office applications spawning unexpected child processes.
Disable features and protocol handlers that are not needed.
Train users on phishing, since almost every Follina attack started with an email.
Segment networks to limit lateral movement after a breach.
CONCLUSION
Follina showed that disabling macros is no longer enough to stay safe with Office documents. A trusted diagnostic tool became a path to code execution, and a padded HTML file was all it took to reach it. The technical flaw mattered, but so did the response. The weeks the bug sat unaddressed after being reported are a reminder that how a vendor handles disclosure is as important as the fix itself.
REFERENCES
Huntress. (2022). Rapid response: Microsoft Office RCE "Follina" MSDT attack. https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
OWASP Foundation. (n.d.). The Follina vulnerability: A critical threat to Microsoft Office. https://owasp.org/www-community/vulnerabilities/follina
Cybersecurity Dive. (2022, June 15). Microsoft releases long sought patch for Office Follina zero day. https://www.cybersecuritydive.com/news/microsoft-patch-office-follina-zero-day/625527/
The Hacker News. (2022, June 7). State-backed hackers exploit Microsoft 'Follina' bug to target entities in Europe and U.S. https://thehackernews.com/2022/06/state-backed-hackers-exploit-microsoft.html
Logpoint. (2023, October 30). Detecting Follina: Microsoft Office remote code execution zero-day. https://www.logpoint.com/en/blog/detecting-follina-microsoft-office-remote-code-execution-zero-day/
Top comments (0)