Security News > 2021 > December > New Exploit Lets Malware Attackers Bypass Patch for Critical Microsoft MSHTML Flaw

New Exploit Lets Malware Attackers Bypass Patch for Critical Microsoft MSHTML Flaw
2021-12-28 19:33

A short-lived phishing campaign has been observed taking advantage of a novel exploit that bypassed a patch put in place by Microsoft to fix a remote code execution vulnerability affecting the MSHTML component with the goal of delivering Formbook malware.

"The attachments represent an escalation of the attacker's abuse of the CVE-2021-40444 bug and demonstrate that even a patch can't always mitigate the actions of a motivated and sufficiently skilled attacker," SophosLabs researchers Andrew Brandt and Stephen Ormandy said in a new report published Tuesday.

CVE-2021-40444 relates to a remote code execution flaw in MSHTML that could be exploited using specially crafted Microsoft Office documents.

Although Microsoft addressed the security weakness as part of its September 2021 Patch Tuesday updates, it has been put to use in multiple attacks ever since details pertaining to the flaw became public.

The new campaign discovered by Sophos aims to get around the patch's protection by morphing a publicly available proof-of-concept Office exploit and weaponizing it to distribute Formbook malware.

"In the initial versions of CVE-2021-40444 exploits, [the] malicious Office document retrieved a malware payload packaged into a Microsoft Cabinet file," the researchers explained.


News URL

https://thehackernews.com/2021/12/new-exploit-lets-malware-attackers.html

Related Vulnerability

DATE CVE VULNERABILITY TITLE RISK
2021-09-15 CVE-2021-40444 Path Traversal vulnerability in Microsoft products
<p>Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows.
0.0

Related vendor

VENDOR LAST 12M #/PRODUCTS LOW MEDIUM HIGH CRITICAL TOTAL VULNS
Microsoft 365 50 1369 2819 161 4399