Follina (CVE-2022-30190): a Word document that ran code without macros

Publicly disclosed: 30 May 2022

At the end of May 2022 researchers found Word documents that, when opened, used the ms-msdt: protocol to launch the Microsoft Support Diagnostic Tool and run PowerShell commands. Macro protection did not help, and with RTF files even the Explorer preview pane was enough. Microsoft published guidance on 30 May 2022 and fixed it in the June 2022 updates. It was used in real attacks, including by state-backed groups.

How to protect

1. Install updates.
2. Before the fix, Microsoft's workaround was to disable the ms-msdt protocol (export the key first so it can be restored):

reg export HKEY_CLASSES_ROOT\ms-msdt ms-msdt-backup.reg
reg delete HKEY_CLASSES_ROOT\ms-msdt /f

3. Use email filtering and attachment sandboxing; block Office from creating child processes with Attack Surface Reduction rules.
4. Train employees not to open unexpected documents.

Good Windows patching habits

• Install Patch Tuesday updates (second Tuesday of every month) within days for internet-facing systems and within two weeks for the rest.
• Watch for out-of-band updates — Microsoft releases them only for serious issues.
• Replace Windows versions that no longer receive security updates.

Sources: Microsoft MSRC guidance, NVD CVE-2022-30190.

Need help with this? Contact CySec for a free consultation.

All articles