Description
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights.
Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Windows 10 Version 1809 | 10.0.17763.0 – < 10.0.17763.3046, 10.0.0 – < 10.0.17763.3046 | 10.0.17763.3046 |
| Microsoft | Windows Server 2019 | 10.0.17763.0 – < 10.0.17763.3046 | 10.0.17763.3046 |
| Microsoft | Windows Server 2019 (Server Core installation) | 10.0.17763.0 – < 10.0.17763.3046 | 10.0.17763.3046 |
| Microsoft | Windows 10 Version 21H1 | 10.0.0 – < 10.0.19043.1766 | 10.0.19043.1766 |
| Microsoft | Windows Server 2022 | 10.0.20348.0 – < 10.0.20348.770 | 10.0.20348.770 |
| Microsoft | Windows 10 Version 20H2 | 10.0.0 – < 10.0.19042.1766 | 10.0.19042.1766 |
| Microsoft | Windows Server version 20H2 | 10.0.0 – < 10.0.19042.1766 | 10.0.19042.1766 |
| Microsoft | Windows 11 version 21H2 | 10.0.0 – < 10.0.22000.739 | 10.0.22000.739 |
| Microsoft | Windows 10 Version 21H2 | 10.0.19043.0 – < 10.0.19044.1766 | 10.0.19044.1766 |
| Microsoft | Windows 10 Version 1507 | 10.0.10240.0 – < 10.0.10240.19325 | 10.0.10240.19325 |
| Microsoft | Windows 10 Version 1607 | 10.0.14393.0 – < 10.0.14393.5192 | 10.0.14393.5192 |
| Microsoft | Windows Server 2016 | 10.0.14393.0 – < 10.0.14393.5192 | 10.0.14393.5192 |
| Microsoft | Windows Server 2016 (Server Core installation) | 10.0.14393.0 – < 10.0.14393.5192 | 10.0.14393.5192 |
| Microsoft | Windows 7 | 6.1.0 – < 6.1.7601.25984 | 6.1.7601.25984 |
| Microsoft | Windows 7 Service Pack 1 | 6.1.0 – < 6.1.7601.25984 | 6.1.7601.25984 |
| Microsoft | Windows 8.1 | 6.3.0 – < 6.3.9600.20402 | 6.3.9600.20402 |
| Microsoft | Windows Server 2008 R2 Service Pack 1 | 6.1.7601.0 – < 6.1.7601.25984 | 6.1.7601.25984 |
| Microsoft | Windows Server 2008 R2 Service Pack 1 (Server Core installation) | 6.1.7601.0 – < 6.1.7601.25984 | 6.1.7601.25984 |
| Microsoft | Windows Server 2012 | 6.2.9200.0 – < 6.2.9200.23736 | 6.2.9200.23736 |
| Microsoft | Windows Server 2012 (Server Core installation) | 6.2.9200.0 – < 6.2.9200.23736 | 6.2.9200.23736 |
| Microsoft | Windows Server 2012 R2 | 6.3.9600.0 – < 6.3.9600.20402 | 6.3.9600.20402 |
| Microsoft | Windows Server 2012 R2 (Server Core installation) | 6.3.9600.0 – < 6.3.9600.20402 | 6.3.9600.20402 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Microsoft Office Word MSDTJS
exploit/windows/fileformat/word_msdtjs_rce
GitHub 95 repositories · most starred shown
-
komomon/CVE-2022-30190-follina-Office-MSDT-Fixed ★ 390 · Jun 2, 2022
CVE-2022-30190-follina.py-修改版，可以自定义word模板，方便实战中钓鱼使用。
-
JMousqueton/PoC-CVE-2022-30190 ★ 158 · May 30, 2022
POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina
-
onecloudemoji/CVE-2022-30190 ★ 104 · May 31, 2022
CVE-2022-30190 Follina POC
-
doocop/CVE-2022-30190 ★ 59 · May 31, 2022
Microsoft Office Word Rce 复现(CVE-2022-30190)
-
Malwareman007/Deathnote ★ 38 · Jun 8, 2022
Proof of Concept of CVE-2022-30190
-
archanchoudhury/MSDT_CVE-2022-30190 ★ 37 · May 31, 2022
This Repository Talks about the Follina MSDT from Defender Perspective
-
Hrishikesh7665/Follina_Exploiter_CLI ★ 34 · Jun 9, 2022
Exploit Microsoft Zero-Day Vulnerability Follina (CVE-2022-30190)
-
MalwareTech/FollinaExtractor ★ 32 · Jun 15, 2022
Extract payload URLs from Follina (CVE-2022-30190) docx and rtf files
-
ErrorNoInternet/FollinaScanner ★ 23 · Jun 2, 2022
A tool written in Go that scans files & directories for the Follina exploit (CVE-2022-30190)
-
Noxtal/follina ★ 21 · Jun 3, 2022
All about CVE-2022-30190, aka follina, that is a RCE vulnerability that affects Microsoft Support Diagnostic Tools (MSDT) on Office apps such as Word. This is a very simple POC, feel free to check th…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- MSRC-CVE-2022-30190 Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability Microsoft Security Response Center · Jun 14, 2022