Hackers Exploit CVE-2021-40444 Through Malicious Office and RTF Files
Summary
Huntress reported in-the-wild exploitation of CVE-2021-40444, an MSHTML code-execution flaw abused through malicious Office and RTF files, including Windows Explorer Preview. Huntress's initial tests found Microsoft's later patch effective.
Key points
- The advisory describes CVE-2021-40444 as an MSHTML arbitrary-code-execution vulnerability affecting modern Windows systems, with a severity score of 8.8.
- Attackers used specially crafted Office documents and RTF files; the activity was especially prevalent in phishing, and Office exploitation did not require VBA macros.
- Huntress reported that RTF files could trigger exploitation through Windows Explorer Preview Mode, potentially without opening the file.
- Some samples seen in the wild were staging Cobalt Strike, according to Huntress; the vulnerability alone did not provide persistence.
- Microsoft's initial workaround of disabling ActiveX controls could be ineffective because the RTF technique did not require ActiveX.
- Huntress recommended keeping antivirus engines updated and described scanning DOCX files for suspicious external references, while cautioning that this method alone was insufficient.
- By September 14, Huntress's initial patch tests found exploitation failed: the RTF test did not download its CAB file, while the DOCX test downloaded it but did not execute code.
Article Details
- Vulnerability Types
- Arbitrary code execution
- Severity
- 8.8
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Microsoft recommended disabling installation of ActiveX controls through Internet Explorer security-zone settings; the article reports this workaround may be ineffective because exploitation does not require ActiveX.
- Microsoft updated its advisory to recommend disabling Preview Mode in Windows Explorer and offered a Group Policy option.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 104[.]194[.]10[.]21 | IP address listed as an indicator associated with active CVE-2021-40444 threats. |
| IPV4 | 45[.]147[.]229[.]242 | IP address listed as an indicator associated with active CVE-2021-40444 threats. |
| MD5 | 1d2094ce85d66878ee079185e2761beb | File hash listed as an indicator associated with active CVE-2021-40444 threats. |
| SHA256 | 049ed15ef970bd12ce662cffa59f7d0e0b360d47fac556ac3d36f2788a2bc5a4 | File hash listed as an indicator associated with active CVE-2021-40444 threats. |
| SHA256 | 199b9e9a7533431731fbb08ff19d437de1de6533f3ebbffc1e13eeffaa4fd455 | File hash listed as an indicator associated with active CVE-2021-40444 threats. |
| SHA256 | 2e328b32f8c7081fbe0aa8407b1b93d1120ac1c8a6aa930eeba1985c55a0daa0 | File hash listed as an indicator associated with active CVE-2021-40444 threats. |
| SHA256 | 3bddb2e1a85a9e06b9f9021ad301fdcde33e197225ae1676b8c6d0b416193ecf | File hash listed as an indicator associated with active CVE-2021-40444 threats. |
| SHA256 | 4477d161958522d5d0dd0cfc4e6d38b0459654184c4ee2b9bce78d2524d7bc9d | File hash listed as an indicator associated with active CVE-2021-40444 threats. |
| SHA256 | 4d5acce20cfa4ff5cf5003b03aa6081959db25e4eca795b2e5f4191c04c5be32 | File hash listed as an indicator associated with active CVE-2021-40444 threats. |
| SHA256 | 5b85dbe49b8bc1e65e01414a0508329dc41dc13c92c08a4f14c71e3044b06185 | File hash listed as an indicator associated with active CVE-2021-40444 threats. |
| SHA256 | 8a31b04c1396c79efca3daa801310a16addf59d41834ea100fe9cededd3e3bad | File hash listed as an indicator associated with active CVE-2021-40444 threats. |
| SHA256 | 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 | File hash listed as an indicator associated with active CVE-2021-40444 threats. |
| SHA256 | a5f55361eff96ff070818640d417d2c822f9ae1cdd7e8fa0db943f37f6494db9 | File hash listed as an indicator associated with active CVE-2021-40444 threats. |
| SHA256 | d0e1f97dbe2d0af9342e64d460527b088d85f96d38b1d1d4aa610c0987dca745 | File hash listed as an indicator associated with active CVE-2021-40444 threats. |
| SHA256 | d0fd7acc38b3105facd6995344242f28e45f5384c0fdf2ec93ea24bfbc1dc9e6 | File hash listed as an indicator associated with active CVE-2021-40444 threats. |
| URL | hxxp[:]//dodefoh[.]com | Referenced URL listed as an indicator associated with active CVE-2021-40444 threats. |
| URL | hxxp[:]//hidusi[.]com | Referenced URL listed as an indicator associated with active CVE-2021-40444 threats. |
| URL | hxxp[:]//joxinu[.]com | Referenced URL listed as an indicator associated with active CVE-2021-40444 threats. |
| URL | hxxp[:]//pawevi[.]com | Referenced URL listed as an indicator associated with active CVE-2021-40444 threats. |
MITRE ATT&CK
T1105 · Ingress Tool TransferThe exploit downloads a malicious CAB file from a remote location to prepare code execution.T1203 · Exploitation for Client ExecutionA specially crafted Office document or RTF file can exploit CVE-2021-40444 to execute arbitrary code through MSHTML.T1566.001 · Spearphishing AttachmentThe article describes phishing as a prevalent delivery vector for malicious Office documents exploiting CVE-2021-40444.
CVE
People
Joseph RoosenHelped identify that the attack does not require ActiveX controls, making the recommended workaround potentially ineffective.Kevin BeaumontIdentified that the attack does not require ActiveX controls and considered releasing non-malicious proof-of-concepts.Rich WarrenValidated exploitation through Windows Explorer Preview Mode using an RTF file and developed an example PoC and video demonstration.
Vendors
Products
Microsoft OfficeOn September 7, Huntress was made aware of a new threat against Windows operating systems and Microsoft Office products.Microsoft WindowsOn September 7, Huntress was made aware of a new threat against Windows operating systems and Microsoft Office products.MSHTMLWith the identifier CVE-2021-40444, the MSHTML engine is vulnerable to arbitrary code execution by a specially crafted Microsoft Office document or rich text format file.Windows DefenderWe have seen Windows Defender now trigger and prevent execution, seemingly based off the ../ characters present.
Tools
Cobalt StrikeSome samples that have been discovered in the wild have been staging Cobalt Strike, a threat emulation framework often abused by threat actors.oleobjThe Linux command-line utility oleobj will also display external references.oletoolsTo scan a DOCX file you feel might have the CVE-2021-40444 exploit, researcher @decalage has shared a Python script to use oletools and look for an mshtml:http external reference abused in this attack.SysmonSwiftOnSecurity has also showcased that there may be artifacts left in the HKEY_CURRENT_USER Registry hive and can be detected with Sysmon.