CVE-2022-30190

CVE-2022-30190: Microsoft Support Diagnostic Tool (MSDT) Remote Code Execution (Follina)

AI-generated analysis based on the vulnerability data on this page.

Summary

A remote code execution vulnerability exists when the Microsoft Support Diagnostic Tool (MSDT) is called using the URL protocol from a calling application such as Microsoft Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application, potentially installing programs, viewing or modifying data, or creating new accounts.

Background

Microsoft Support Diagnostic Tool (MSDT) is a legitimate Windows utility designed to collect diagnostic information and send it to Microsoft support. The tool can be invoked via the ms-msdt: URL protocol handler, which is registered in Windows. Applications such as Microsoft Word can embed or trigger this protocol handler, for example through HTML content in documents. CVE-2022-30190, also known as "Follina," leverages this mechanism to achieve code execution without traditional macro-based execution.

Root Cause

The root cause of this vulnerability lies in the unsafe handling of the ms-msdt: URI scheme by the Microsoft Support Diagnostic Tool. When a calling application invokes this protocol, MSDT processes arbitrary commands without adequate sandboxing or validation. The specific CWE classification is not publicly assigned in the available data, but the underlying weakness aligns with improper neutralization of special elements or insufficient input validation.

Impact

• Confidentiality Impact: Complete (HIGH in CVSS v3.1) — an attacker can read sensitive data.
• Integrity Impact: Complete (HIGH in CVSS v3.1) — an attacker can modify or delete data.
• Availability Impact: Complete (HIGH in CVSS v3.1) — an attacker can disrupt system operations.
• Scope: Unchanged — the vulnerable component does not impact resources beyond its security scope.
• User Interaction: Required — the victim must interact with a malicious document (e.g., open a file).

The CVSS v2 score of 9.3 reflects network accessibility with medium complexity, while the CVSS v3.1 score of 7.8 localizes the attack vector to the endpoint once the user is tricked into interaction.

Exploitation Walkthrough

Ethics Caveat: This section is provided for defensive awareness only. The following describes the general attack flow at a high level; no weaponized exploit code is included.

1. Delivery: An attacker sends a malicious document (e.g., a Word file) or crafts a webpage containing an embedded ms-msdt: URI.
2. Invocation: When the victim opens the document or interacts with the content, the calling application invokes the MSDT URL protocol.
3. Command Execution: MSDT processes the payload, which can include arbitrary commands or PowerShell execution, running with the privileges of the calling application (typically the logged-in user).
4. Post-Exploitation: With code execution achieved, the attacker may proceed with lateral movement, persistence, or data exfiltration.

Defenders should focus on detecting suspicious ms-msdt: invocations and blocking unknown documents at the email gateway.

Affected and Patched Versions

Affected Products:

• Microsoft Windows 10 (versions 1507, 1607, 1809, 20H2, 21H1, 21H2)
• Microsoft Windows 11 (version 21H2)
• Microsoft Windows 7 SP1
• Microsoft Windows 8.1
• Microsoft Windows RT 8.1
• Microsoft Windows Server 2008 R2 SP1
• Microsoft Windows Server 2012 and 2012 R2
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Windows Server 2022
• Microsoft Windows Server 20H2

Patched Versions: Specific patch information is not provided in the available data. Microsoft released security updates in June 2022; refer to the Microsoft Security Response Center for the latest patch guidance.

Remediation

1. Apply Security Updates: Install the June 2022 (or later) Windows cumulative updates from Microsoft.
2. Disable MSDT URL Protocol: As a compensating control, unregister the ms-msdt: handler if the tool is not required in your environment. This can be done via registry modification (backup the registry key first).
3. Disable Office Active Content: Block external content in Office applications and disable ActiveX/embedded objects where not needed.
4. Email and Web Gateway Filtering: Block or sandbox Office documents from untrusted sources.
5. Least Privilege: Ensure users operate with standard privileges, not administrative rights, to limit the impact of successful exploitation.

Detection

• Process Monitoring: Alert on msdt.exe being spawned by Office applications (e.g., winword.exe) or by browsers.
• Command Line Inspection: Monitor for unusual command-line arguments passed to msdt.exe.
• Registry Monitoring: Detect changes to the ms-msdt: URL protocol handler.
• Network Signatures: Look for unexpected outbound connections initiated by msdt.exe.
• Endpoint Detection and Response (EDR): Use EDR tools to correlate document open events with child process creation.

Assessment

This vulnerability carries an EPSS score of 0.99374 (99.93rd percentile), indicating near-certain exploitation in the wild. It was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2022-06-14, confirming active exploitation. The high CVSS v2 score (9.3) and the "Follina" moniker reflect the severity and widespread attention this flaw received.

Key Lessons:

1. Protocol handlers are a high-value attack surface. URL schemes registered in the operating system can bridge trusted applications (e.g., Word) to system utilities, creating unexpected code execution paths.
2. Document-based attacks remain prevalent. User interaction is required, but social engineering and email-based delivery make this a realistic and dangerous vector.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
• http://packetstormsecurity.com/files/167438/Microsoft-Office-Word-MSDTJS-Code-Execution.html
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30190
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30190