New details about the recent MSHTML zero-day vulnerability have further spooked cybersecurity (opens in new tab) researchers, after having seen exploits in the wild.
Tracked as CVE-2021-40444, Microsoft recently disclosed the vulnerability (opens in new tab) in Internet Explorer (opens in new tab)’s browser engine Trident, also known as MSHTML, which helps render browser-based content inside Microsoft Office (opens in new tab) documents.
Microsoft was careful not to share too many details about the still-unpatched vulnerability. However, security researchers have been more forthcoming after analyzing malicious Office documents used in real-world campaigns.
- Take a look at our list of the best web browsers (opens in new tab)
- Protect your devices with these best antivirus software (opens in new tab)
- These are the best malware removal (opens in new tab) software on the market
BleepingComputer has shared details about the dangerous nature of the vulnerability, which can work around built-in protection mechanisms in both Microsoft Office and Office 365 (opens in new tab).
Exercise extreme caution
In an ideal world, Microsoft Office’s "Protected View" feature is enough to block the exploit, since it exists in documents that come from the internet.
However, vulnerability analyst Will Dormann told BleepingComputer that there are several ways for a malicious document to bypass Protected View by obfuscating the fact that it came from the internet. For instance, documents opened from inside containers like zipped archives, or ISO files, are treated as local files.
Moreover, Dormann discovered that you could use this vulnerability in RTF files as well, which don’t get the protections of the Protected View feature.
While Microsoft hasn’t yet shared a patch to plug the vulnerability, it has shared mitigations (opens in new tab) to block documents from processing ActiveX content, thereby defanging the exploit.
However, that’s not of much help either, since security researcher Kevin Beaumont has already discovered a way (opens in new tab) to bypass Microsoft's mitigations to exploit this vulnerability.
Until Microsoft fixes the vulnerability, it’s best to avoid opening documents from unknown sources.
- Here are the best ransomware protection tools (opens in new tab)
Via BleepingComputer (opens in new tab)