Cymulate which is a leading provider of Breach & Attack Simulation (BAS) solutions announced today it has reported a security flaw in Microsoft Office Suite which may affect Word users.
Using this method, an attacker potentially tricks the user into installing a fake software update and potential victims would receive no security warning when opening the corrupted document.
It is suspected that this act potentially affects all users of Office 2016 and older versions of the software suite. Cymulate told SC Media that it has reported the bug to Microsoft three months ago, noting however that the flaw did not qualify for an official CVE identifier.
When asked about the Cymulate’s claims, Jeff Jones, senior director at Microsoft told SC Media, “The product is properly interpreting HTML as designed — working in the same manner as similar products. ”
Attackers can exploit the flaw by first embedding a video inside a Word document, then unpacking the doc in order to single out the file “document.xml.” After that, the factors can replace that XML file’s iframe code with a crafted payload. After it’s self-execution, this code will use the msSaveOrOpenBlob method to trigger the download of the executable by opening Internet Explorer Download Manager with the option to run or save the file.