Analysis and utilization of Microsoft Office Word remote command execution vulnerability (cve-2022-30190)

One 、 Vulnerability profile

CVE-2022-30190 Holes in the 2022 year 5 month 27 Japan , from nao_sec Found one from Belarus IP Upload to VirusTotal Malice Word file . This document uses Microsoft Word Remote template function link malicious HTML file ,Winword.exe The program handles the malicious HTML In the document js Code found using ”ms-msdt” Agreed URL, Then start msdt.exe Program (Microsoft Support Diagnostics Tool) Handle the URL, Cause embedded in URL Medium powershell The command is executed .

2022 year 5 month 30 Japan , Microsoft released the vulnerability number CVE-2022-30190.

Vulnerability status

Vulnerability details

Loophole POC

Loophole EXP

Use in the field