Microsoft Fixes Windows CVE-2021-40444 MSHTML Zero-day Flaw

Microsoft recently fixed a high asperity zero-day vulnerability actively exploited in targeted attacks against Microsoft Office 365 on Windows 10 computers. The remote code execution (RCE) security bug, tracked as CVE-2021-40444, was discovered in the MSHTML Internet Explorer browser interpreting engines utilized by Microsoft Office documents.

According to Microsoft, CVE-2021-40444 affects Windows Server 2008 through 2019 and Windows 8.1 or later, and it has a severity level of 8.8 out of the maximum 10.

Microsoft has released security updates to address such vulnerabilities, “the organization stated in a recent advisory release published as part of this month’s patch Tuesday. “Please go through the Security Updates table for the applicable update for your system. We suggest that you install these updates immediately.”

What are the Security Updates Released After Built-in Defenses Bypassed?

The targeted attacks analyzed by Microsoft tried to exploit the vulnerability by transmitting specially-crafted Office documents with malicious ActiveX controls to probable victims. Fortunately, these attacks were circumventing if Microsoft Office ran with the default configuration, which opens unauthorized documents in Protected View mode (or with Application Guard for Office 365 customers).

However, as CERT/CC vulnerability analyst Will Dormann later told our experts, this built-in protection against CVE-2021-40444 exploits would likely be prevented either by users ignoring Protected View alerting or by threat actors delivering the malicious documents bundled within 7Zip archives or ISO containers.

If the document is in a container that is processed by something that is not MotW-aware, then the fact that the container was downloaded from the Internet will be moot. For example, if 7Zip opens an archive that came from the Internet, the extracted contents will not indicate that it came from the Internet. So no MotW, no Protected View.

Similarly, if the document is in a container like an ISO file, a Windows user can simply double-click on the ISO to open it. But Windows doesn’t treat the contents as having come from the Internet. So again, No MotW, No Protected View.

This attack is more dangerous than macros because any organization that has chosen to disable or otherwise limit Macro execution will still be open to arbitrary code execution simply as the result of opening an Office document. – Will Dormann

Furthermore, Dormann also found that threat actors could exploit this vulnerability using maliciously crafted RTF files, which don’t benefit from Office’s Protected View security feature.    


How to Apply these Securities Updates?

Recently Security Updates address the vulnerability for all the impacted versions of Windows and include a Monthly Rollup, a Security Only update, and an Internet Explorer cumulative update. “Customers running Windows 8.1, Windows Servers 2012 R2, or Windows Server 2012 can apply either the Monthly Rollup or both of the Security Only and the IE cumulative updates,” as per Microsoft.

“The Monthly Rollup for Windows 7, Windows Server 2008 R2, and Windows Server 2008 includes the update for this vulnerability. Customers who apply the Monthly Rollup do not need to apply the IE Cumulative update. “Customers who only apply Security-only updates need to also apply the IE Cumulative update to be protected from this vulnerability.”

Our experts independently confirmed that known CVE-2021-40444 exploits no longer work after applying today’s patches. Those who cannot immediately apply today’s security updates should implement Microsoft’s workarounds (disabling ActiveX controls via Group Policy and preview in Windows Explorer) to reduce the attack surface.     

Leave a Reply