Exploited Vulnerabilities

Follina(CVE-2022-30190)

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability. The Microsoft Support Diagnostic Tool (MSDT) is a service that is designed to diagnose and troubleshoot problems with Microsoft products.
What makes this MS Word vulnerability unique is the fact that there are no macros exploited in this attack. it affects ALL Microsoft Office versions – 2013 and above abd also latest Windows Server 2022.

All an attacker needs to do is lure a targeted user to download a Microsoft document or view an HTML file embedded with the malicious code.Here are the steps we observed:

• Step 1: The attacker sends an email containing a malicious Microsoft Office document (.docx, etc.) to the targeted user.
• Step 2: The user executes this file, which resolves and executes the attacker-controlled external resource from the document.xml.ref file.
• Step 3: Code exploiting the Follina vulnerability is now served to the user.
• Step 4: This code then launches additional commands like downloading Remote Access Trojans, etc.

Log4Shell (CVE-2021-44228)

Spring4Shell (CVE-2022-22965)

Microsoft Office bug (CVE-2017-11882)

ProxyNotShell (CVE-2022-41082)

Zimbra Collaboration Suite bugs (CVE-2022-27925)

Atlassian Confluence - RCE flaw(CVE-2022-26134)

F5 BIG-IP(CVE-2022-1388)

Chrome zero-day (CVE-2022-0609)

Zyxel RCE vulnerability (CVE-2022-30525)