Microsoft Office Word users can be hacked easily?

Microsoft Office Word users can be hacked easily?

Cymulate which is a leading provider of Breach & Attack Simulation (BAS) solutions announced today it has reported a security flaw in Microsoft Office Suite which may affect Word users.

Researchers at company Cymulate are claiming to have found a vulnerability in Microsoft Word’s online video feature that can allow harmful software to replace legitimate YouTube iframe code with harmful HTML/JavaScript code.
Using this method, an attacker potentially tricks the user into installing a fake software update and potential victims would receive no security warning when opening the corrupted document.

It is suspected that this act potentially affects all users of Office 2016 and older versions of the software suite. Cymulate told SC Media that it has reported the bug to Microsoft three months ago, noting however that the flaw did not qualify for an official CVE identifier.

When asked about the Cymulate’s claims, Jeff Jones, senior director at Microsoft told SC Media, “The product is properly interpreting HTML as designed — working in the same manner as similar products. ”

Attackers can exploit the flaw by first embedding a video inside a Word document, then unpacking the doc in order to single out the file “document.xml.” After that, the factors can replace that XML file’s iframe code with a crafted payload. After it’s self-execution, this code will use the msSaveOrOpenBlob method to trigger the download of the executable by opening Internet Explorer Download Manager with the option to run or save the file.

Leave a Reply

Your email address will not be published. Required fields are marked *

Single Column Posts

Single Column Posts Subtitle