Message-ID: <CAFD2FDMtwt5-8DnwNwcs5NuGAQjSt8FWz7NmAuNqj8jWMCgZsA@mail.gmail.com>
Date: Fri, 14 Jun 2019 22:05:31 -0400
From: hyp3rlinx <apparitionsec@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Microsoft Word (2016) / Deceptive File Reference Vuln

[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WORD-DECEPTIVE-FILE-REFERENCE.txt
[+] ISR: ApparitionSec
[+] Zero Day Initiative Program


[Vendor]
www.microsoft.com


[Product]
Microsoft Word 2016


[Vulnerability Type]
Deceptive File Reference


[References]
ZDI-CAN-7949


[Security Issue]
When a MS Word ".docx" File contains a hyperlink to another file, it will
run the first file it finds in that directory with a
valid extension. But will present to the end user an extension-less file in
its Security warning dialog box without showing the extension type.
If another "empty" file of the same name as the target executable exists
but has no file extension. Because the extension is supressed it
makes the file seem harmless and the file can be masked to appear as just a
folder etc.

This can potentially trick user into running unexpected code, but will only
work when you have an additional file of same name with
NO extension on it.


[Exploit/POC]
1) Create a directory "PoC"

2) Create a folder in PoC directory named "Downloads Folder"

3) Create a .BAT file named "Downloads Folder.bat"

in the .BAT create some command like "start calc.exe"

4) Create an empty file named "Downloads Folder" with no file extension

5) Create the Word ".docx" file with a hyperlink pointing to "PoC/Downloads
Folder/Downloads Folder"

Upon opening the link Word will give user an vague dialog box about asking
if they want to open
the file. However, the prompt shows an apparent folder structure and no
file extension .exe, .com etc
are visible or displayed to the end user.

Click the link to open what looks to be a folder then BOOM! the .BAT file
runs instead.

Of course any exeuctable will do .EXE etc.


[Network Access]
Local


[Severity]
High


[POC Video URL]
https://www.youtube.com/watch?v=irxkV_qGG9Y


[Disclosure Timeline]
Notification: Trend Micro Zero Day Initiative Program : 2019-01-25

Case officially contracted to ZDI : 2019-02-06

Vendor Disclosure : 2019-02-15
submitted to the vendor as ZDI-CAN-7949.

ZDI Response : "We have synced with the vendor and they have resolved that
this case
does not meet the bar for security servicing. Therefore we will proceed to
close it on our end."

2019-06-14 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the
information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author
prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists