CVE-2017-0199: high-severity vulnerability in Microsoft Corporation Office/WordPad
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA, has a working public exploit and 9 threat group(s) use it.
ssvc Actcvss 7.8epss 99%
from disclosure to weapon1 day
Published on NVDApr 12
1st PoC+1d
metasploit+2d
CISA KEV+1666d
Who exploits it — 9
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
APT / StateAPT37🇰🇵 MITRE ATT&CK
APT / StateAPT41🇨🇳 MITRE ATT&CK
APT / StateBlackTech🇨🇳 MITRE ATT&CK
APT / StateCobalt Group MITRE ATT&CK
APT / StateLeviathan🇨🇳 MITRE ATT&CK
APT / StateMuddyWater🇮🇷 MITRE ATT&CK
APT / StateMustang Panda🇨🇳 MITRE ATT&CK
APT / StatePatchwork🇮🇳 MITRE ATT&CK
APT / StateTA459🇨🇳 MITRE ATT&CK
Action required by CISAfederal deadline: 2022-05-03
Apply updates per vendor instructions.
In short
Microsoft Office and WordPad have a vulnerability that allows attackers to execute malicious code on your computer by sending you a specially crafted document. If you open the document, the attacker gains control of your system.
Technical detail
Remote code execution vulnerability in Microsoft Office 2007-2016 and WordPad affecting Windows Vista through Windows 8.1, exploitable through crafted documents that abuse Windows API functionality. Attack vector is network-based via document delivery; requires user interaction (opening the file); results in arbitrary code execution with user privileges.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API."
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Microsoft Corporation · Office/WordPadpublic PoCs found — 47✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/41934exploitdbwww.exploit-db.com/exploits/42995unverifiedexploitdbwww.exploit-db.com/exploits/41894unverifiedgithubgithub.com/bhdresh/CVE-2017-0199★ 726githubgithub.com/haibara3839/CVE-2017-0199-master★ 16githubgithub.com/NotAwful/CVE-2017-0199-Fix★ 13githubgithub.com/SyFi/cve-2017-0199★ 12githubgithub.com/Exploit-install/CVE-2017-0199★ 7githubgithub.com/jacobsoo/RTF-Cleaner★ 3githubgithub.com/n1shant-sinha/CVE-2017-0199★ 2githubgithub.com/nicpenning/RTF-Cleaner★ 2githubgithub.com/ahmed-tarek22752/RCE-CVE-2017-0199-detection-analysis★ 2githubgithub.com/mzakyz666/PoC-CVE-2017-0199★ 2githubgithub.com/Sunqiz/CVE-2017-0199-reprofuction★ 2githubgithub.com/kn0wm4d/htattack★ 2githubgithub.com/ahmed-tarek22752/security-vulnerability-in-Microsoft-Office.★ 2githubgithub.com/herbiezimmerman/2017-11-17-Maldoc-Using-CVE-2017-0199★ 2githubgithub.com/Phantomlancer123/CVE-2017-0199★ 1githubgithub.com/viethdgit/CVE-2017-0199★ 0githubgithub.com/joke998/Cve-2017-0199★ 0githubgithub.com/joke998/Cve-2017-0199-★ 0githubgithub.com/ryhanson/CVE-2017-0199★ 0githubgithub.com/likekabin/CVE-2017-0199★ 0githubgithub.com/BRAINIAC22/CVE-2017-0199★ 0githubgithub.com/BlackOclock/XLS-to-DBatLoader-or-GuLoader-for-AgentTesla-variant★ 0githubgithub.com/kash-123/CVE-2017-0199★ 0githubgithub.com/stealth-ronin/CVE-2017-0199-PY-KIT★ 0githubgithub.com/sUbc0ol/Microsoft-Word-CVE-2017-0199-★ 0githubgithub.com/TheCyberWatchers/CVE-2017-0199-v5.0★ 0cve_referencewww.exploit-db.com/exploits/41934/unverifiedvulncheckvulncheck.com/xdb/970b6cfbc7fbunverifiedvulncheckvulncheck.com/xdb/0dd660910a33unverifiedvulncheckvulncheck.com/xdb/ed3b3ae95b69unverifiedvulncheckvulncheck.com/xdb/2924f4e487d3unverifiedvulncheckvulncheck.com/xdb/6318b2a065f3unverifiedvulncheckvulncheck.com/xdb/945fef08ea28unverifiedvulncheckvulncheck.com/xdb/aacae3861886unverifiedvulncheckvulncheck.com/xdb/9ef95e7ea4b5unverifiedvulncheckvulncheck.com/xdb/7c99d68f36e5unverifiedvulncheckvulncheck.com/xdb/532c2574ee56unverifiedvulncheckvulncheck.com/xdb/5b55113c6830unverifiedvulncheckvulncheck.com/xdb/306bb11d6afeunverifiedcve_referencewww.exploit-db.com/exploits/41894/unverifiedvulncheckvulncheck.com/xdb/612660bafddcunverifiedcve_referencewww.exploit-db.com/exploits/42995/unverifiedvulncheckvulncheck.com/xdb/448adc18dbf6unverifiedvulncheckvulncheck.com/xdb/206bc924258eunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.htmlhttps://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0199https://www.exploit-db.com/exploits/41894/https://www.exploit-db.com/exploits/41934/https://www.exploit-db.com/exploits/42995/https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.htmlhttps://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/http://www.securityfocus.com/bid/97498http://www.securitytracker.com/id/1038224