Follina (CVE-2022-30190)

Background

Follina is the informal name given to CVE-2022-30190, a remote code execution vulnerability affecting the Microsoft Windows Support Diagnostic Tool (MSDT). MSDT is a legacy Windows utility that allows Microsoft technical support agents to collect diagnostic data remotely for troubleshooting. The vulnerability involves the way MSDT is invoked through the ms-msdt URL protocol handler, which can be triggered from within Microsoft Office documents such as Word files.

Discovery and disclosure

The vulnerability was publicly surfaced on May 27, 2022, after the security research group nao_sec identified and shared a malicious Word document that had been uploaded to VirusTotal from an IP address in Belarus. The document, purportedly related to Russia's war against Ukraine, used a remote template feature in Word to fetch an HTML file that then invoked the ms-msdt protocol handler to execute PowerShell code, without requiring macros to be enabled. Security researchers, including those tracking the sample, gave the vulnerability the nickname "Follina" after a postal code referenced in the sample's file metadata. Microsoft assigned the identifier CVE-2022-30190 on May 30, 2022.

How the exploit works

According to Microsoft's own advisory, the vulnerability exists when MSDT is invoked using the URL protocol from a calling application such as Word. An attacker who successfully exploits the vulnerability can run arbitrary code with the privileges of the calling application, which in typical Office scenarios means code execution in the context of the user who opened the document. Because the exploit relies on the ms-msdt URL scheme rather than on Office macros or scripting, it evaded many macro-focused detection and mitigation controls that organizations had put in place after years of macro-based malware campaigns. Notably, the malicious code could reportedly execute even with macros disabled and, in some analyses, without the document needing to be fully opened, depending on the preview and rendering behavior of the host application.

Exploitation in the wild

Before an official patch was available, Follina was actively exploited by multiple threat actors. Researchers reported exploitation attempts against targets in Russia and Belarus beginning around April 2022, predating the public disclosure. Separately, security researchers linked suspected Chinese state-sponsored activity to attacks using the Follina exploit against the Tibetan government-in-exile, based in Dharamshala, India, in campaigns themed around Tibetan cultural and political topics. The relative ease of weaponizing the exploit, combined with the lack of an immediate patch, led to rapid adoption of the technique by additional cybercriminal groups following public disclosure.

Microsoft's response and patch

Microsoft initially downplayed early private reports of the underlying MSDT behavior, but after nao_sec's public disclosure and subsequent widespread attention, the company issued a security advisory and interim mitigation guidance on May 30, 2022, before a formal patch was ready. The recommended workaround involved manually deleting the ms-msdt registry key (using a command such as "reg delete HKEY_CLASSES_ROOT\ms-msdt /f") to disable the URL protocol handler, which prevented the exploit while still preserving other MSDT functionality such as the Get Help app and Windows Settings troubleshooters. Microsoft released an official fix as part of its June 14, 2022 Patch Tuesday updates (including KB5015805), and later shipped a defense-in-depth fix for a related variant in its July 12, 2022 cumulative updates.

Significance and legacy

Follina is frequently cited as an example of how legacy Windows utilities with URL protocol handlers can be repurposed as initial-access vectors, independent of the macro-based delivery methods that had dominated Office-based attacks for years. Its disclosure prompted renewed scrutiny of MSDT and similar diagnostic tools, and it remains a commonly referenced case study in vulnerability research and incident response training regarding zero-day disclosure timelines, coordinated (or uncoordinated) vulnerability reporting, and the effectiveness of registry-based interim mitigations ahead of vendor patches.

Timeline

• 2022-04Exploitation of the underlying MSDT flaw reportedly begins against targets in Russia and Belarus, predating public disclosure.
• 2022-05-27Security research group nao_sec publicly discloses a malicious Word document exploiting the flaw, and the vulnerability is nicknamed "Follina."
• 2022-05-30Microsoft assigns the identifier CVE-2022-30190 and publishes advisory guidance with an interim registry-based workaround.
• 2022-06-14Microsoft releases an official patch (including update KB5015805) as part of its June Patch Tuesday cumulative updates.
• 2022-07-12Microsoft ships an additional defense-in-depth fix addressing a related variant in its July cumulative updates.