New details about the recent MSHTML zero-day vulnerability have further spooked cybersecurity researchers, after having seen exploits in the wild.
Tracked as CVE-2021-40444, Microsoft recently disclosed the vulnerability in Internet Explorer’s browser engine Trident, also known as MSHTML, which helps render browser-based content inside Microsoft Office documents.
Microsoft was careful not to share too many details about the still-unpatched vulnerability. However, security researchers have been more forthcoming after analyzing malicious Office documents used in real-world campaigns.
We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and we’d hugely appreciate if you’d share your experiences with us.
BleepingComputer has shared details about the dangerous nature of the vulnerability, which can work around built-in protection mechanisms in both Microsoft Office and Office 365.
Exercise extreme caution
In an ideal world, Microsoft Office’s “Protected View” feature is enough to block the exploit, since it exists in documents that come from the internet.
However, vulnerability analyst Will Dormann told BleepingComputer that there are several ways for a malicious document to bypass Protected View by obfuscating the fact that it came from the internet. For instance, documents opened from inside containers like zipped archives, or ISO files, are treated as local files.
Moreover, Dormann discovered that you could use this vulnerability in RTF files as well, which don’t get the protections of the Protected View feature.
While Microsoft hasn’t yet shared a patch to plug the vulnerability, it has shared mitigations to block documents from processing ActiveX content, thereby defanging the exploit.
However, that’s not of much help either, since security researcher Kevin Beaumont has already discovered a way to bypass Microsoft’s mitigations to exploit this vulnerability.
Until Microsoft fixes the vulnerability, it’s best to avoid opening documents from unknown sources.
Via BleepingComputer
