36 lines
No EOL
2 KiB
Text
36 lines
No EOL
2 KiB
Text
Title: MS Office Excel (all versions) Arbitrary Code Execution Vulnerability
|
||
|
||
Date: September 30th, 2017.
|
||
|
||
Author: Eduardo Braun Prado
|
||
|
||
Vendor Homepage: http://www.microsoft.com/
|
||
|
||
Software Link: https://products.office.com/
|
||
|
||
Version: 2007,2010,2013,2016 32/64 bits (x86 and x64)
|
||
|
||
Tested on: Windows 10/8.1/8.0/7/Server 2012/Server 2008/Vista (X86 and x64)
|
||
|
||
CVE: 2017-0199
|
||
|
||
|
||
Description:
|
||
|
||
MS Excel contains a remote code execution vulnerability upon processing OLE objects. Although this is a different issue from the
|
||
MS Word HTA execution vulnerability, it has been patched together, 'silently'. By performing some tests from the Word HTA PoC posted
|
||
on exploit-db[dot]com, it´s possible to exploit it through Excel too, however the target would need to either accept a security warning
|
||
regarding external links or double click inside the Excel window, same applies for Powerpoint, so I guess this is the reason, Word caught
|
||
the attention and no exploit PoC was made available to other Office apps.
|
||
|
||
This vulnerability exists in the way Excel handles parameters passed to the "DDEService" attribute of links, leading to the search for a
|
||
program to display it. As it does not impose restrictions on what program is going to be executed, for instance, only programs located in the
|
||
Office install directory, it is possible to invoke arbitrary local programs with parameters, leading to system compromise.
|
||
Since Excel blocks automatic update of linked files, the target must be tricked into double clicking anywhere inside the document.
|
||
(The linked object occupies basicly the whole document window). Without the patch applied no warning/prompt is shown;
|
||
With the patch a prompt is shown asking if it´s ok to run 'xxxx.exe', where 'xxxx.exe' can have arbitrary names as long as it´s at most 8
|
||
chars long, so we could still fake/spoof it as another Office app (the app name cannot be the same of the legitimate, eg. 'Excel').
|
||
|
||
|
||
Proof of Concept:
|
||
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42995.zip |