{"uuid": "56fb58c9-0f32-4d7d-9604-b4cc6d8f0815", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23137", "content": "Black Hat Ethical Hacking\nMicrosoft shares temp fix for ongoing Office 365 zero-day attacks\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft shares temp fix for ongoing Office 365 zero-day attacksPost Views: 83 \nReading Time: 1 Minute\nMicrosoft shared yesterday a mitigation for\u00a0a remote code execution vulnerability in Windows that is being exploited in targeted attacks against Office 365 and Office 2019 on Windows 10.\nThe flaw is in MSHTML, the browser rendering engine that is also used by Microsoft Office documents. Ongoing attacks against Office 365Identified as CVE-2021-40444, the security issue affects Windows Server 2008 through 2019 and Windows 8.1 through 10 and has a severity level of 8.8 out of the maximum 10.\n\nMicrosoft is aware of targeted attacks that try to exploit the vulnerability by sending specially-crafted Microsoft Office documents to potential victims, the company says in an advisory\u00a0today.\n\u201cAn attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document\u201d \u2013 Microsoft\nHowever, the attack is thwarted if Microsoft Office runs with the default configuration, where documents from the web are opened in Protected View mode or Application Guard for Office 365.\n\nProtected View is a read-only mode that has most of the editing functions disabled, while Application Guard isolates untrusted documents, denying them access to corporate resources, the intranet, or other files on the system.\n\nSystems with active Microsoft\u2019s Defender Antivirus and Defender for Endpoint (build 1.349.22.0 and above) benefit from protection against attempts to exploit CVE-2021-40444.\n\nMicrosoft\u2019s enterprise security platform will display alerts about this attack as \u201cSuspicious Cpl File Execution.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Researchers from multiple cybersecurity companies are credited for finding and reporting the vulnerability: Haifei Li of EXPMON, Dhanesh Kizhakkinan, Bryce Abdo, and Genwei Jiang \u2013 all three\u00a0of Mandiant, and Rick Cole of Microsoft Security Intelligence.\n\nIn a tweet today, EXPMON (exploit monitor)\u00a0says that they found the vulnerability after detecting a \u201chighly sophisticated zero-day attack\u201d aimed at Microsoft Office users.\nhttps://www.bleepstatic.com/images/news/u/1100723/2021/EXPMONBug-40444.jpg \n<figcaptionsource: EXPMON \nEXPMON researchers reproduced the attack on the latest\u00a0Office 2019 / Office 365 on Windows 10.\n\nIn a reply to BleepingComputer, Haifei Li\u00a0of EXPMON said that the attackers used a .DOCX file. Upon opening it, the document loaded the Internet Explorer engine to render a remote web page from the threat actor.\n\nMalware is then downloaded by using a specific ActiveX control in the web page. Executing the threat is done using \u201ca trick called \u2018Cpl File Execution\u2019,\u201d referenced in Microsoft\u2019s advisory.\n\nThe researcher told us that the attack method is 100% reliable, which makes it very dangerous. He reported the vulnerability\u00a0to Microsoft early Sunday morning.\nSee Also: Bluetooth Bugs Open Billions of Devices to DoS, Code Execution Workaround for CVE-2021-40444 zero-day attacksAs there is no security update available at this time, Microsoft has provided the following workaround \u2013 disable the installation of all ActiveX controls in Internet Explorer.\n\nA Windows registry update ensures that ActiveX is rendered inactive for all sites, while already available ActiveX controls will keep functioning.\n\nUsers should save the file below with the .REG extension and execute it t[...]", "creation_timestamp": "2026-09-01T20:02:25.021128Z"}