{"uuid": "b96cd147-a879-4c0e-ae7e-d0c1b93565c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23538", "content": "Black Hat Ethical Hacking\nWindows MSHTML zero-day exploits shared on hacking forums\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Windows MSHTML zero-day exploits shared on hacking forumsPost Views: 101 \nReading Time: 2 Minutes\nThreat actors are sharing Windows MSHTML zero-day\u00a0(CVE-2021-40444) tutorials\u00a0and exploits on hacking forums, allowing other hackers to start exploiting the new vulnerability in their own attacks.\nLast Tuesday, Microsoft disclosed a new zero-day vulnerability in Windows MSHTML\u00a0that allows threat actors to create malicious documents, including Office and RTF docs, to execute commands on a victim\u2019s computer remotely.\n\nEven though there are no security updates available for the CVE-2021-40444 vulnerability, as it was discovered used in active attacks by EXPMON\u00a0and Mandiant, Microsoft decided to disclose the vulnerability and provide mitigations to help prevent its exploitation.\n\nThese mitigations work by blocking ActiveX controls and Word/RTF document previews in Windows Explorer.\n\nHowever, researchers have been able to modify the exploit\u00a0not to use ActiveX, effectively bypassing Microsoft\u2019s mitigations. Guides and PoCs shared on hacking forumsWhen Microsoft first disclosed the Windows MSHTML zero-day, tracked as CVE-2021-40444, security researchers quickly found the malicious documents used in attacks.\n\nWhile they soon reproduced the exploits, modified\u00a0them for further capabilities, and discovered a new document preview vector, the researchers did not disclose details for fear other threat actors would abuse it.\n\nUnfortunately, threat actors have been able to reproduce the exploit on their own from information, and malicious document samples posted online and have begun sharing detailed guides and information on hacking forums.\n\nStarting on Thursday, threat actors began sharing public information about the HTML component of the exploit and how to create the malicious document. On Friday, more instructions were posted on generating the payload and a CAB file that included the path traversal vulnerability component.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/hacking-forums/forum-post.jpg \nDefending against the CVE-2021-40444 MSHTML vulnerability The good news is that since the vulnerability was disclosed, Microsoft Defender and other security programs can detect and block malicious documents and CAB files used in this attack.\n\nFor example, you can see below Microsoft Defender blocking the exploit as\u00a0\u2018Trojan:Win32/CplLoader.a\u2019 and \u2018TrojanDownloader:HTML/Donoff.SA\u2019 detections.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/CVE-2021-40444/hacking-forums/defender-detecting.jpg \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:24.779422Z"}