CVE-2017-0199

CVE-2017-0199: Microsoft Office / WordPad Remote Code Execution via HTA Handler Abuse

AI-generated analysis based on the vulnerability data on this page.

Summary

CVE-2017-0199 is a remote code execution vulnerability in Microsoft Office and WordPad. An attacker can deliver a crafted document that, when opened, causes the application to fetch and execute an HTA (HTML Application) payload via the Windows API. Successful exploitation grants the attacker full control of the affected system with the privileges of the opening user.

Background

In April 2017, Microsoft patched this vulnerability as part of its monthly security updates. The flaw quickly became one of the most exploited vulnerabilities in Office-based attack chains. Threat actors embedded malicious links inside RTF and Office documents that leveraged the htafile handler. Because the interaction required only that a victim open a document (with possible additional interaction depending on the delivery method), the vulnerability was rapidly adopted by multiple crimeware and targeted-attack campaigns.

Root Cause

The root cause is improper handling of embedded OLE2 links combined with the Windows HTA handler. When an Office or WordPad document contains a specially crafted link object pointing to an external HTA resource, the application fetches the resource and passes it to the Windows shell for execution without sufficient validation or sandboxing. The input data does not specify a CWE ID, so the exact mapping is unconfirmed; behaviorally, the issue aligns with insufficient control of filename or path (CWE-73) and improper neutralization of script-related HTML tags (CWE-80), but this mapping is speculative and should be treated as unverified.

Impact

• CVSS v2: 9.3 — Network exploitable with medium complexity, no authentication required, and complete impact on confidentiality, integrity, and availability.
• CVSS v3.1: 7.8 — Local attack vector after user interaction is required; the scope is unchanged, but the impact on confidentiality, integrity, and availability remains high.
• EPSS: 0.99933 indicates near-certain probability of exploitation in the wild.
• KEV-listed since 2021-11-03, confirming active, widespread exploitation by threat actors.

Exploitation Walkthrough

An attacker typically:

1. Crafts a document (RTF, DOC, or other Office format) embedding a link to a remote HTA file.
2. Delivers the document via phishing email or other social engineering.
3. Waits for the victim to open the document.
4. The Office/WordPad application retrieves the HTA and invokes the Windows HTA handler, executing attacker-controlled script on the local system.

Ethics caveat: This description is intentionally defensive and generic. No weaponized exploit code is provided. Security teams should use this understanding to build detection rules and user-awareness programs, not to construct attacks.

Affected and Patched Versions

Affected products (per CPE data):

• Microsoft Office 2007 SP3
• Microsoft Office 2010 SP2
• Microsoft Office 2013 SP1
• Microsoft Office 2016
• Microsoft Windows Vista SP2
• Windows Server 2008 SP2
• Windows Server 2008 R2 SP1
• Windows Server 2012
• Windows 7 SP1
• Philips IntelliSpace Portal 7.0
• Philips IntelliSpace Portal 8.0

Patched versions: Microsoft released patches in April 2017. Specific build numbers are not included in the source data; administrators should apply the April 2017 (or later) Microsoft security updates for the relevant Office and Windows versions.

Remediation

1. Patching: Apply the official Microsoft security updates for CVE-2017-0199. Prioritize Office 2010/2013/2016 and affected Windows systems.
2. Compensating controls:
   • Disable Office macros and embedded OLE objects where not required.
   • Block HTA file execution via Application Control (AppLocker / WDAC).
   • Restrict outbound connections from Office applications where possible.
   • Enable Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint to block Office apps from creating child processes.
3. Email security: Use mail-gateway filtering to strip or quarantine documents containing suspicious OLE links or HTA references.

Detection

• Monitor endpoint telemetry for Office/WordPad processes spawning mshta.exe or making unexpected outbound HTTP/HTTPS requests.
• Look for network connections to rare or newly registered domains immediately after Office document open events.
• Enable Microsoft Defender Antivirus / EDR detections for exploit behavior tied to CVE-2017-0199.
• Leverage KEV and EPSS data in vulnerability-management workflows to ensure this CVE remains tracked until all affected assets are patched or retired.

Assessment

CVE-2017-0199 is a textbook example of a high-impact Office vulnerability that transitions from disclosure to widespread exploitation in days. With an EPSS above 99.9% and a confirmed KEV entry, defenders should treat any unpatched instance as actively targeted.

Key lessons:

1. Documents from external sources must be opened in isolated or sandboxed environments before being trusted.
2. EPSS and KEV data are essential for prioritizing patches when CVE volume exceeds patching capacity.

References

• http://rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html
• http://www.securityfocus.com/bid/97498
• http://www.securitytracker.com/id/1038224
• https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199
• https://www.exploit-db.com/exploits/41894/
• https://www.exploit-db.com/exploits/41934/
• https://www.exploit-db.com/exploits/42995/
• https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html
• https://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0199