Security News Abusing Microsoft Office Online Video

[In2an3_PpG]

Content source

https://blog.cymulate.com/abusing-microsoft-office-online-video

Abusing Microsoft Office Online Video

Cymulate’s research team has discovered a way to abuse the Online Video feature on Microsoft Word to execute malicious code (Read the press release here).

Attackers could use this for malicious purposes such as phishing, as the document will show the embedded online video with a link to YouTube, while disguising a hidden html/javascript code that will be running in the background and could potentially lead to further code execution scenarios.

This attack is carried out by embedding a video inside a Word document, editing the XML file named document.xml, replacing the video link with a crafted payload created by the attacker which opens Internet Explorer Download Manager with the embedded code execution file.

A workflow of how this security flaw could be produced:

1. Create a Word Document.

2. Embed an online video: Insert -> online video and add any YouTube video.

3. Save the Word document with the embedded online video.

4. Unpack the Word document:

Docx files are actually a package of all the media files that you may see in a docx file. If you unpack the file – either by using an unpacker or changing the docx extension to zip and unzipping it – there are several files and directories in a single docx file:

5. Edit the document.xml file under word folder

6. Inside the .xml file, look for embeddedHtml parameter (under WebVideoPr) which contains the Youtube iframe code. Replace the current iframe code with any html code / javascript to be rendered by Internet Explorer.

7. Save the changes in document.xml file, update the docx package with the modified xml and open the document.

We’ve created a PoC that contains the embedded executable (as a blob of a base64). Once run, this code will use the msSaveOrOpenBlob method to trigger the download of the executable by opening Internet Explorer Download Manager with the option to run or save the file.

Please note: No security warning is presented while opening this document with Microsoft Word.



Mitigation:
Block Word documents containing the tag: “embeddedHtml” in the Document.xml file of the word documents.

Workaround:
Block word documents containing an embedded video.

 

[509322]

Abusing Microsoft Office Online Video

Cymulate’s research team has discovered a way to abuse the Online Video feature on Microsoft Word to execute malicious code (Read the press release here).

Attackers could use this for malicious purposes such as phishing, as the document will show the embedded online video with a link to YouTube, while disguising a hidden html/javascript code that will be running in the background and could potentially lead to further code execution scenarios.

This attack is carried out by embedding a video inside a Word document, editing the XML file named document.xml, replacing the video link with a crafted payload created by the attacker which opens Internet Explorer Download Manager with the embedded code execution file.

Microsoft will keep the vulnerability in-place, and attempt to solve the issue by some convoluted solution. As Microsoft typically does.

 

[Eddie Morra]

I can't wait for NASA to announce an open-project about sending humans to the planet Mars. My excitement for such a project increases every-time Microsoft do something stupid.

There was a funny mistake with the web-based version of Skype awhile back... It allowed you to send links to people who were using either the web-based or Desktop version of Skype, but hijack the destination URL whilst still controlling the displayed text. This essentially would trick them into believing they'd be going to [real website] when in actual fact, they'd be re-directed to [another website].

 

[509322]

I can't wait for NASA to announce an open-project about sending humans to the planet Mars. My excitement for such a project increases every-time Microsoft do something stupid.

There was a funny mistake with the web-based version of Skype awhile back... It allowed you to send links to people who were using either the web-based or Desktop version of Skype, but hijack the destination URL whilst still controlling the displayed text. This essentially would trick them into believing they'd be going to [real website] when in actual fact, they'd be re-directed to [another website].

Sort of like... "I have the solution to all your Earthly problems... move to Mars."

 

[Eddie Morra]

Unless of course... Microsoft came along with you. Then you're doomed.

Imagine that! You strap into the NASA rocket and after you're already thousands of miles into space, a little pocket out the side of the ship falls off... and that's when you see a computer screen with the "Windows 10" logo digitally displayed on the front. At that moment, you knew you screwed up.

 

[upnorth]