Advisory 2022-1134 - Microsoft Windows: Vulnerability allows execution of arbitrary code

Notice: You can now also find information from the Vulnerability Advisory Service in the CTI portal!
The CTI portal is available at the following address: https://cti-portal.telekom.net/advisories/2022-1134

Notice: This advisory is by exception shown completely public. You will regularly receive details on vulnerability information as a customer via your login or through our daily advisory e-mail.

4	Attack probability medium-high
4	Potential damage medium-high

Date: 2022-05-30
Release: 2022-06-15 UPDATE

Operating System

Windows

Software

Microsoft Windows

Attack

A remote anonymous attacker can exploit a vulnerability in Microsoft Windows in order to execute arbitrary code.

Description

Windows ist ein Betriebssystem von Microsoft.

CVE-2022-30190

A vulnerability exists in Microsoft Windows. The vulnerability is due to a flaw in the Microsoft Support Diagnostic Tool (MSDT) when using the URL protocol. It affects any application in Windows that processes URLs. It can be exploited using a specially crafted file that contains a corresponding URL. A remote, anonymous attacker can use this to execute arbitrary program code. User action is required for successful exploitation. Successful exploitation requires a user action, such as opening a file.

CVSSv2 Base Score: 6.8 / Temporal Score: 6.5
AV:N/AC:M/AU:N/C:P/I:P/A:P/E:H/RL:W/RC:ND
CVSSv3.1 Base Score: 9.6 / Temporal Score: 9.2
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:H/RL:O/RC:X

Exploit code taking advantage of the vulnerability is available on the Internet. According to reports, the vulnerability has already been leveraged in targeted attacks.

Recommendation

At present no update or patch for the removal of this vulnerability is available.
https://twitter.com/buffaloverflow/status/1530866518279565312

UPDATE 2022-05-31

Microsoft describes a workaround. For further information please consult the vendor's advisory.
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-30190

UPDATE 2022-06-15

Microsoft provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-30190

Information

Tweet dated 2022-05-29
https://twitter.com/buffaloverflow/status/1530866518279565312

Kevin Beaumont via Double Pulsar dated 2022-05-29
https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e

UPDATE 2022-05-31

Guidance for CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability dated 2022-05-30
https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/

UPDATE 2022-06-15

Microsoft Security Guidance CVE-2022-30190 dated 2022-06-14
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-30190

References

CVE:CVE-2022-30190
VULNAME:FOLLINA

Disclaimer

*The probability of an attack is determined by the attacker's motivation, the necessary expend and the possibilities for an attack. The damage probability is determined by the expend needed to resolute the attack and probable indirect consequences of an attack for business processes. Telekom Security assumes worst case scenarios.

Copyright © 1999-2026 Deutsche Telekom Security GmbH. All rights reserved. Reproduction and distribution of this publication in any form - even in parts - without prior written permission is forbidden.

The information contained herein has been obtained from sources believed to be reliable and trusted or have been verified. Telekom Security can take liability for completeness, accuracy and correctness only in so far, as gross negligence or intention create liability. Any liability beyond it, in particular possible damages resulting from using or non-usability of the information contained herein, is excluded.

Information on the use of cookies