CVE-2017-0199

CVE-2017-0199 is a significant software vulnerability, specifically a flaw in the design or implementation of older versions of Microsoft Office and Windows. This vulnerability allows for remote code execution, making it an attractive vector for cyber attacks. Throughout its history, it has been exploited by numerous malware families, including Dridex in 2017 and Guloader in 2021. According to BlackBerry, more than 5,600 malware samples have exploited this issue within a single year, with 15 malicious samples originating from Egypt. The exploitation of CVE-2017-0199 was not limited to criminal actors; state-sponsored groups also utilized it. Notably, APT34, a group allegedly linked to Iran, quickly incorporated exploits for this vulnerability (alongside CVE-2017-11882) to target organizations in the Middle East. While there wasn't extensive activity involving Middle Eastern actors, two reports highlighted the use of CVE-2017-0199 as a zero-day exploit in this region. In response to the widespread exploitation of this vulnerability, NSP customers received new signatures related to the "HTTP: Microsoft Office OLE Arbitrary Code Execution Vulnerability (CVE-2017-0199)" attack. The decoy files used in these attacks often rely on a remote template injection technique (CVE-2017-0199) to gain initial access to the target's system, underscoring the importance of these added signatures in detecting and preventing future exploits.