CVE-2022-30190

CVE-2022-30190, also known as the "Follina" vulnerability, is a high-risk software flaw in the Microsoft Support Diagnostic Tool that allows for remote code execution. This 0-day vulnerability was disclosed in May 2022 and has since been exploited by threat actors, including TA413, who weaponized it shortly after its discovery and publication. The exploitation of this vulnerability begins with a spear-phishing email containing a malicious Excel spreadsheet attachment. When opened, the vulnerability is used to download an MSI package from a remote server. Throughout the first half of 2022, TA413 not only exploited this vulnerability but also leveraged a now-patched zero-day vulnerability targeting the Sophos Firewall product (CVE-2022-1040). Additionally, they employed a newly observed custom backdoor known as LOWZERO in campaigns specifically targeting Tibetan entities. In June 2022, the group shifted their strategy and began using an exploit of the Follina vulnerability instead of malicious VBA code. The Follina vulnerability has been widely exploited and carries a high CVSS score of 7.8, indicating its severity. It has been used in various attack vectors, including being weaponized within a Microsoft Office document to drop Woody Rat malware. Alongside the PrintNightmare vulnerability (CVE-2021-34527), Follina's exploitation has been reported extensively, highlighting the significant security risk it poses to Microsoft users.