Follina (CVE-2022-30190): The Office Attack That Needed No Macros

Summary

Follina, CVE-2022-30190, is a Windows vulnerability that became public at the end of May 2022, after a malicious document sample was uploaded to VirusTotal and analysed by researchers. It allowed remote code execution through Microsoft Office documents, and was exploited in the wild before a patch was available.

Technical Root Cause

The vulnerability was in the Microsoft Support Diagnostic Tool (MSDT) and its ms-msdt: URI protocol handler. An Office document could reference a remote HTML file, which in turn invoked the ms-msdt: handler with a crafted payload. MSDT then executed the supplied PowerShell, inheriting the privileges of the calling application. This is CWE-94 (Improper Control of Generation of Code).

Why It Mattered

For roughly two decades, the standard organisational defence against malicious Office documents has been to disable macros, and that guidance became near universal after Microsoft began blocking macros from internet-sourced files by default. Follina executed code with macros disabled entirely, because it never used them. In some configurations the preview pane alone was sufficient, meaning the document did not have to be fully opened.

That combination defeated both the primary technical control and the user-training message ("do not enable macros") that most organisations had standardised on.

OWASP / CWE Mapping

• CWE-94: Improper Control of Generation of Code
• Related to CWE-610: Externally Controlled Reference to a Resource in Another Sphere

Lasting Impact

Follina prompted broader scrutiny of Windows URI protocol handlers as an attack surface, an area that had received relatively little attention compared to macros and scripting. The interim mitigation, before a patch shipped, was to unregister the ms-msdt: protocol handler from the registry, which is unusual as official guidance and reflects how few other options existed.

How Safeguard Helps

This is an operating system and endpoint issue rather than a software supply chain one, so it sits outside dependency scanning. The transferable point is about control assumptions: a defence that blocks one execution path ("macros") does not necessarily cover the capability it was meant to contain ("documents can run code"), and it is worth periodically testing whether a control still covers its stated objective.

References

• CVE-2022-30190: https://nvd.nist.gov/vuln/detail/CVE-2022-30190
• CWE-94: https://cwe.mitre.org/data/definitions/94.html