{"uuid": "da56e52b-a874-43e8-ae2a-ebefddd96248", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40444", "type": "seen", "source": "https://t.me/hacking_Attack/23539", "content": "e following mitigations to block ActiveX controls in Internet Explorer, the default handler for the MSHTML protocol, and block document preview in Windows Explorer. Disable ActiveX controls in Internet ExplorerTo disable ActiveX controls, please follow these steps:\n\n1. Open Notepad and paste the following text into a text file. Then save the file as disable-activex.reg. Make sure you have the displaying of file extensions enabled\u00a0to properly create the Registry file.\n\n \nAlternatively, you can download the registry file from here. Windows Registry Editor Version 5.00\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\2]\n\"1001\"=dword:00000003\n\"1004\"=dword:00000003\n\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\3]\n\"1001\"=dword:00000003\n\"1004\"=dword:000000032. Find the newly created disable-activex.reg and double-click on it. When a\u00a0UAC prompt is displayed, click on the Yes\u00a0button to import the Registry entries.\n3. Reboot your computer to apply the new configuration.\n\nOnce you reboot your computer, ActiveX controls will be disabled in Internet Explorer.\n\nYou can enable ActiveX controls again by deleting the above Registry keys or using this Registry file.\nSee Also: Offensive Security Tool: Jenkins Attack Framework Disable document preview in Windows ExplorerSecurity researchers have also found that this vulnerability can be exploited by viewing a malicious document using the Windows Explorer preview feature.\nCVE-2021-40444 is so bad\ud83e\udd26\u200d\u2642\ufe0f pic.twitter.com/3Gu9ahwmHd\n\n\u2014 jq0904 (@jq0904) September 10, 2021\nSince this was discovered, Microsoft has added the following mitigation to disable previewing of RTF and Word documents:\n\n1. In the Registry Editor (regedit.exe), navigate to the appropriate registry key: \nFor Word documents, navigate to these keys:\n\n* HKEY_CLASSES_ROOT.docx\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n* HKEY_CLASSES_ROOT.doc\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n* HKEY_CLASSES_ROOT.docm\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n\nFor rich text files (RTF), navigate to this key:\n\n* HKEY_CLASSES_ROOT.rtf\\ShellEx{8895b1c6-b41f-4c1c-a562-0d564250836f}\n\n2. Export a copy of the Registry key as a backup.\n3. Now double-click Name\u00a0and in the Edit String\u00a0dialog box, delete the Value Data.\n4. Click OK, See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerWord document and RTF file previews are now disabled in Windows Explorer.\n\nTo enable Windows Explorer preview for these documents, double-click on the backup .reg file you created in step 2 above.\n\nWhile these mitigations will help, as the exploit has been modified not to use ActiveX controls, users are still at risk until an official security update is released.\n\nUntil Microsoft releases a security update, everyone should treat all Word and RTF attachments suspiciously and their source manually verified before opening them.\nSource: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project\u2019s Confluence server hacked to mine Monero5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unnamed-e1[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:24.826823Z"}