Back
Outfaze Security Team

Outfaze Security Team

Follina CVE-2022-30190: A Practical Response Guide

Follina CVE-2022-30190: A Practical Response Guide

Microsoft published guidance for CVE-2022-30190 on May 30, 2022. The vulnerability allowed the Microsoft Support Diagnostic Tool URL protocol to be invoked from a calling application such as Word, potentially leading to code execution with the user's privileges.

The disclosure evolved from workaround guidance to security updates in June and defense-in-depth updates in July. Teams had to manage a changing advisory without freezing on the first mitigation.

Documents crossed an unexpected trust boundary

A user could encounter a malicious document that caused an Office process to invoke a diagnostic protocol. This connected email and document handling to a Windows component that many asset inventories did not treat as an exposed service.

Microsoft supplied endpoint, antivirus, network, and email detection information. That allowed defenders to combine remediation with a search for attempted or successful exploitation.

Track temporary and permanent controls separately

Record which endpoints received a workaround, which received the security update, and when the workaround can be safely reversed. Validate deployment coverage rather than assuming a centrally approved update reached every device.

Hunt for suspicious Office-to-MSDT process relationships and related payload activity using current vendor detections. Review user rights because code executing as a standard user has a different impact from code executing with local administrator privilege.

  • Subscribe to advisory revisions.
  • Label workarounds with owners and expiry criteria.
  • Correlate email, document, process, and network telemetry.
  • Reduce local administrator rights.

Put the lesson into practice

  1. Find affected Windows systems and update status.
  2. Apply current cumulative security updates.
  3. Reconcile and retire temporary workarounds.
  4. Hunt for suspicious Office and MSDT behavior.
  5. Review mail controls and endpoint privilege.

Related Outfaze guidance

Authoritative sources