Software Engineering Institute

Microsoft OLE uses the URL Moniker to processes remotely-linked content in a vulnerable manner. The remote content is opened based on the application associated with the server-provided MIME type. Some MIME types are dangerous, as they can result in code execution. For example, the application/hta mime type is associated with mshta.exe. Opening arbitrary HTA content is equivalent to executing arbitrary code. This vulnerability is reportedly being exploited in the wild. The exploits used in the wild have the following characteristics:

• The document that triggers the URL Moniker vulnerability is an RTF document that masquerades as a Microsoft Word DOC file.
• The exploit connects to a remote server to obtain an execute an HTA file, which contains VBScript to be executed by the client.

By convincing a user to open a specially-crafted document, an unauthenticated remote attacker may be able to execute arbitrary code on a vulnerable system.

The CERT/CC is currently unaware of a practical solution to this problem. Please consider the following workarounds;

Apply an update

This issue is addressed in the following Microsoft Security update: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199
Please refer to this document and install all relevant updates for both Microsoft Windows and Microsoft Office.

Note: Even with these updates, remotely-linked OLE content is still retrieved and saved according to server-provided MIME type before any user interaction if the document is not in Protected Mode. The update prevents HTA content from being executed after it has been retrieved in such a manner.

Disable the application/hta MIME handler

This exploit appears to be blocked by disabling the MIME handler for application/hta. The handler for this MIME type can be overridden with the "plain text" handler using the following registry value:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\application/hta]
"CLSID"="{5e941d80-bf96-11cd-b579-08002b30bfeb}"

Block RTF documents in Microsoft Word

Exploits in the wild utilize RTF documents. RTF documents can be blocked in Microsoft Word by using the File Block Settings in the Microsoft Office Trust Center. For example, the following registry values can be used to block the opening of RTF documents in Word 2016:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Security\FileBlock]
"OpenInProtectedView"=dword:00000000
"RtfFiles"=dword:00000002

For other versions of Office, the path above will need to be modified to match the version number associated with the installed version of Office.