Internet Explorer zero-day may be even more dangerous than first thought

By Mayank Sharma
published

Best not to open documents from strangers, experts say

A computer being guarded by cybersecurity.
(Image credit: iStock)
Audio player loading…

New details about the recent MSHTML zero-day vulnerability have further spooked cybersecurity (opens in new tab) researchers, after having seen exploits in the wild. 

Tracked as CVE-2021-40444, Microsoft recently disclosed the vulnerability (opens in new tab) in Internet Explorer (opens in new tab)’s browser engine Trident, also known as MSHTML, which helps render browser-based content inside Microsoft Office (opens in new tab) documents.

Microsoft was careful not to share too many details about the still-unpatched vulnerability. However, security researchers have been more forthcoming after analyzing malicious Office documents used in real-world campaigns.

TechRadar needs yo...

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.

>> Click here to start the survey in a new window (opens in new tab) <<

BleepingComputer has shared details about the dangerous nature of the vulnerability, which can work around built-in protection mechanisms in both Microsoft Office and Office 365 (opens in new tab).

Exercise extreme caution

In an ideal world, Microsoft Office’s "Protected View" feature is enough to block the exploit, since it exists in documents that come from the internet.

However, vulnerability analyst Will Dormann told BleepingComputer that there are several ways for a malicious document to bypass Protected View by obfuscating the fact that it came from the internet. For instance, documents opened from inside containers like zipped archives, or ISO files, are treated as local files.

Moreover, Dormann discovered that you could use this vulnerability in RTF files as well, which don’t get the protections of the Protected View feature.

While Microsoft hasn’t yet shared a patch to plug the vulnerability, it has shared mitigations (opens in new tab) to block documents from processing ActiveX content, thereby defanging the exploit.

However, that’s not of much help either, since security researcher Kevin Beaumont has already discovered a way (opens in new tab) to bypass Microsoft's mitigations to exploit this vulnerability.

Until Microsoft fixes the vulnerability, it’s best to avoid opening documents from unknown sources.

Via BleepingComputer (opens in new tab)

Mayank Sharma
Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.

See more Computing news