目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CVE-2022-30190— Microsoft Windows Support Diagnostic Tool 操作系统命令注入漏洞

一分钟漏洞结论

影响对象
Microsoft Windows 10 Version 1809
利用判断
已确认在野利用，应立即处置
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Microsoft Windows Support Diagnostic Tool是美国微软（Microsoft）公司的收集信息以发送给 Microsoft 支持的工具。 Microsoft Windows Support Diagnostic Tool (MSDT)存在操作系统命令注入漏洞。以下产品和版本受到影响：Windows 10 Version 1809 for 32-bit Systems,Windows 10 Version 1809 for x64-based Systems,Windows

CVSS 7.8 · High KEV · 勒索软件 EPSS 99.16% · P100

公开利用映射 1

Metasploit · 1 word_msdtjs_rce.rb [exploit]

影响版本矩阵 23

厂商产品 版本范围状态
Microsoft Windows 10 Version 1507 10.0.10240.0< 10.0.10240.19325 affected
Microsoft Windows 10 Version 1607 10.0.14393.0< 10.0.14393.5192 affected
Microsoft Windows 10 Version 1809 10.0.17763.0< 10.0.17763.3046 affected
10.0.0< 10.0.17763.3046 affected
Microsoft Windows 10 Version 20H2 10.0.0< 10.0.19042.1766 affected
Microsoft Windows 10 Version 21H1 10.0.0< 10.0.19043.1766 affected
Microsoft Windows 10 Version 21H2 10.0.19043.0< 10.0.19044.1766 affected
Microsoft Windows 11 version 21H2 10.0.0< 10.0.22000.739 affected
Microsoft Windows 7 6.1.0< 6.1.7601.25984 affected
Microsoft Windows 7 Service Pack 1 6.1.0< 6.1.7601.25984 affected
Microsoft Windows 8.1 6.3.0< 6.3.9600.20402 affected
Microsoft Windows Server 2008 R2 Service Pack 1 6.1.7601.0< 6.1.7601.25984 affected
Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation) 6.1.7601.0< 6.1.7601.25984 affected
Microsoft Windows Server 2012 6.2.9200.0< 6.2.9200.23736 affected
Microsoft Windows Server 2012 (Server Core installation) 6.2.9200.0< 6.2.9200.23736 affected
Microsoft Windows Server 2012 R2 6.3.9600.0< 6.3.9600.20402 affected
Microsoft Windows Server 2012 R2 (Server Core installation) 6.3.9600.0< 6.3.9600.20402 affected
Microsoft Windows Server 2016 10.0.14393.0< 10.0.14393.5192 affected
Microsoft Windows Server 2016 (Server Core installation) 10.0.14393.0< 10.0.14393.5192 affected
Microsoft Windows Server 2019 10.0.17763.0< 10.0.17763.3046 affected
Microsoft Windows Server 2019 (Server Core installation) 10.0.17763.0< 10.0.17763.3046 affected
Microsoft Windows Server 2022 10.0.20348.0< 10.0.20348.770 affected
Microsoft Windows Server version 20H2 10.0.0< 10.0.19042.1766 affected
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2022-30190 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
来源: CVE Program / CVE List V5
Vulnerability Description
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Microsoft Windows Support Diagnostic Tool 操作系统命令注入漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Microsoft Windows Support Diagnostic Tool是美国微软（Microsoft）公司的收集信息以发送给 Microsoft 支持的工具。 Microsoft Windows Support Diagnostic Tool (MSDT)存在操作系统命令注入漏洞。以下产品和版本受到影响：Windows 10 Version 1809 for 32-bit Systems,Windows 10 Version 1809 for x64-based Systems,Windows
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD

神龙十问 — AI 深度分析

十问解析：根本原因、利用方式、修复建议、紧迫性。摘要免费，完整版需登录。

查看摘要 完整分析（登录）

受影响产品

厂商 产品 影响版本 CPE 订阅
Microsoft Windows 10 Version 1809 10.0.17763.0 ~ 10.0.17763.3046 -
Microsoft Windows 10 Version 1809 10.0.0 ~ 10.0.17763.3046 -
Microsoft Windows Server 2019 10.0.17763.0 ~ 10.0.17763.3046 -
Microsoft Windows Server 2019 (Server Core installation) 10.0.17763.0 ~ 10.0.17763.3046 -
Microsoft Windows 10 Version 21H1 10.0.0 ~ 10.0.19043.1766 -
Microsoft Windows Server 2022 10.0.20348.0 ~ 10.0.20348.770 -
Microsoft Windows 10 Version 20H2 10.0.0 ~ 10.0.19042.1766 -
Microsoft Windows Server version 20H2 10.0.0 ~ 10.0.19042.1766 -
Microsoft Windows 11 version 21H2 10.0.0 ~ 10.0.22000.739 -
Microsoft Windows 10 Version 21H2 10.0.19043.0 ~ 10.0.19044.1766 -
Microsoft Windows 10 Version 1507 10.0.10240.0 ~ 10.0.10240.19325 -
Microsoft Windows 10 Version 1607 10.0.14393.0 ~ 10.0.14393.5192 -
Microsoft Windows Server 2016 10.0.14393.0 ~ 10.0.14393.5192 -
Microsoft Windows Server 2016 (Server Core installation) 10.0.14393.0 ~ 10.0.14393.5192 -
Microsoft Windows 7 6.1.0 ~ 6.1.7601.25984 -
Microsoft Windows 7 Service Pack 1 6.1.0 ~ 6.1.7601.25984 -
Microsoft Windows 8.1 6.3.0 ~ 6.3.9600.20402 -
Microsoft Windows Server 2008 R2 Service Pack 1 6.1.7601.0 ~ 6.1.7601.25984 -
Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation) 6.1.7601.0 ~ 6.1.7601.25984 -
Microsoft Windows Server 2012 6.2.9200.0 ~ 6.2.9200.23736 -
Microsoft Windows Server 2012 (Server Core installation) 6.2.9200.0 ~ 6.2.9200.23736 -
Microsoft Windows Server 2012 R2 6.3.9600.0 ~ 6.3.9600.20402 -
Microsoft Windows Server 2012 R2 (Server Core installation) 6.3.9600.0 ~ 6.3.9600.20402 -

二、漏洞 CVE-2022-30190 的公开POC

# POC 描述 源链接 神龙链接
1 CVE-2022-30190 (Exploit Microsoft) https://github.com/flux10n/CVE-2022-30190 POC详情
2 POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina https://github.com/JMousqueton/PoC-CVE-2022-30190 POC详情
3 CVE-2022-30190 https://github.com/zkl21hoang/msdt-follina-office-rce POC详情
4 CVE-2022-30190 Follina POC https://github.com/onecloudemoji/CVE-2022-30190 POC详情
5 None https://github.com/2867a0/CVE-2022-30190 POC详情
6 Microsoft Office Word Rce 复现(CVE-2022-30190) https://github.com/doocop/CVE-2022-30190 POC详情
7 This Repository Talks about the Follina MSDT from Defender Perspective https://github.com/archanchoudhury/MSDT_CVE-2022-30190 POC详情
8 Aka Follina = benign POC. https://github.com/rickhenderson/cve-2022-30190 POC详情
9 Picking up processes that have triggered ASR related to CVE-2022-30190 https://github.com/DOV3Y/CVE-2022-30190-ASR-Senintel-Process-Pickup POC详情
10 CVE-2022-30190- A Zero-Click RCE Vulnerability In MSDT https://github.com/kdk2933/msdt-CVE-2022-30190 POC详情
11 Microsoft Sentinel analytic rule and hunting queries in ASIM for activity of MSDT and CVE-2022-30190. https://github.com/sentinelblue/CVE-2022-30190 POC详情
12 None https://github.com/aymankhder/MSDT_CVE-2022-30190-follina- POC详情
13 CVE-2022-30190 remediation via removal of ms-msdt from Windows registry https://github.com/PaddlingCode/cve-2022-30190 POC详情
14 Follina MS-MSDT 0-day MS Office RCE (CVE-2022-30190) PoC in Go https://github.com/dwisiswant0/gollina POC详情
15 None https://github.com/hscorpion/CVE-2022-30190 POC详情
16 Just another PoC for the new MSDT-Exploit https://github.com/drgreenthumb93/CVE-2022-30190-follina POC详情
17 None https://github.com/mitespsoc/CVE-2022-30190-POC POC详情
18 None https://github.com/Vaisakhkm2625/MSDT-0-Day-CVE-2022-30190-Poc POC详情
19 An NSIS script that helps deploy and roll back the mitigation registry patch for CVE-2022-30190 as recommended by Microsoft https://github.com/rouben/CVE-2022-30190-NSIS POC详情
20 Removes the ability for MSDT to run, in response to CVE-2022-30190 (Follina) https://github.com/Cosmo121/Follina-Remediation POC详情
21 CVE-2022-30190 or "Follina" 0day proof of concept https://github.com/rayorole/CVE-2022-30190 POC详情
22 Proof of Concept zu MSDT-Follina - CVE-2022-30190. ÜBERPRÜFUNG DER WIRKSAMKEIT VON MICROSOFT DEFNEDER IN DER JEWEILS AKTUELLSTEN WINDOWS 10 VERSION. https://github.com/ImproveCybersecurityJaro/2022_PoC-MSDT-Follina-CVE-2022-30190 POC详情
23 MS-MSDT Follina CVE-2022-30190 PoC document generator https://github.com/sudoaza/CVE-2022-30190 POC详情
24 MSDT protocol disabler (CVE-2022-30190 patch tool) https://github.com/gamingwithevets/msdt-disable POC详情
25 A tool written in Go that scans files & directories for the Follina exploit (CVE-2022-30190) https://github.com/ErrorNoInternet/FollinaScanner POC详情
26 None https://github.com/ITMarcin2211/CVE-2022-30190 POC详情
27 Mitigates the "Folina"-ZeroDay (CVE-2022-30190) https://github.com/derco0n/mitigate-folina POC详情
28 CVE-2022-30190-follina.py-修改版，可以自定义word模板，方便实战中钓鱼使用。 https://github.com/komomon/CVE-2022-30190-follina-Office-MSDT-Fixed POC详情
29 None https://github.com/gyaansastra/CVE-2022-30190 POC详情
30 None https://github.com/swaiist/CVE-2022-30190-Fix POC详情
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2022-30190 的情报信息

请登录查看更多情报信息。

CVE-2022-30190 厂商安全公告 (2)

CVE-2022-30190 公开利用代码 (1)

同批安全公告 · Microsoft · 2022-06-01 · 共 4 条

CVE-2022-30127 8.3 HIGH Google Chrome 竞争条件问题漏洞
CVE-2022-30128 8.3 HIGH Google Chrome 竞争条件问题漏洞
CVE-2022-26905 4.3 MEDIUM Google Chrome 安全漏洞

IV. Related Vulnerabilities

Same product: Windows 10 Version 1809
Same vendor: Microsoft

V. Comments for CVE-2022-30190

暂无评论

发表评论