Microsoft, CISA urge use of mitigations and workarounds for Office document vulnerability

Microsoft said it has identified a limited number of attacks targeting a remote code execution vulnerability in MSHTML that affects Microsoft Windows.

CISA released its own message urging “users and organizations to review Microsoft’s mitigations and workarounds to address CVE-2021-40444, a remote code execution vulnerability in Microsoft Windows.”

Microsoft said the vulnerability was first discovered by Rick Cole of the Microsoft Security Response Center, Haifei Li of EXPMON as well as Dhanesh Kizhakkinan, Bryce Abdo and Genwei Jiang of Mandiant. 

“Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine,” Microsoft explained. 

“The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.” 

The Microsoft release notes that their Defender Antivirus and Defender for Endpoint protect against the vulnerability. Anyone who has the tools and uses automatic updates is safe from the vulnerability, while they noted that enterprise customers who manage updates “should select the detection build 1.349.22.0 or newer and deploy it across their environments.” 

The alerts in Microsoft Defender will show up as “Suspicious Cpl File Execution.”

Microsoft said once its investigation is finished, they will send out a security update in a Patch Tuesday release or in a separate out-of-cycle security update. 

The release adds that Microsoft Office opens documents from the internet in Protected View or Application Guard for Office by default, both of which prevent the current attack. 

In terms of mitigations and workarounds, Microsoft suggested disabling the installation of all ActiveX controls in Internet Explorer. 

“This can be accomplished for all sites by updating the registry. Previously-installed ActiveX controls will continue to run, but do not expose this vulnerability,” the release said. “If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly.” 

The notice also provide specific instructions on how to disable ActiveX controls on an individual system. 

Mandiant threat analyst Andrew Thompson noted that “robust detections focused on post-exploitation behavior are a safety net that enables you to detect intrusions involving zero day exploitation.”