Windows 10 RCE: via insecure default URI handler

Two researchers found an issue in Windows 10 that allows for a drive-by code execution vulnerability on Windows 10 via IE11/Edge Legacy and MS Teams, activated by an argument injection in the Windows 10/11 default handler for ms-officecmd: URIs. In their report published on researchers` blog they provide a full cover of their findings and additionally added original MSRC report. Lukas Euler and Fabian Bräunlein made the initial disclosure about an issue via https://msrc.microsoft.com/ on 10th of March this year but MS rejected it explaining “[..] your report appears to rely on social engineering [..]”.

Two researchers found an exploit in Windows 10

They retorted in the blog that the rejection was errouneuses due to the lack of technical understanding during triage. And after their appeal MS reopened the issue and assigned it the “Critical, RCE” classification. However no CV has been assigned or advisory published. In the following statement MS said:

“Unfortunately in this case there was no CVE or advisory tied to the report. Most of our CVEs are created to explain to users why certain patches are sent through Windows Update and why they should be installed. Changes to websites, downloads through Defender, or through the Store normally do not get a CVE attached in the same way”.

Generally speaking the vulnerability is in a default URI handler of Windows 10 and can be exploited from various applications. That’s when a Windows 10 user either clicks on a malicious “ms-officecmd:”-link in any application, arbitrary commands can be executed on the victim’s computer or visits a malicious website with Edge. Exploitation through other browsers made necessary to the victims to accept an unnoticeable confirmation dialog. On the other hand, a malicious URI could be send via a desktop application running dangerous URL handling. In their post researchers point out that besides the direct RCE via –gpu-launcher, several other attack scenarios are possible:

The research showed many ways how attackers can exploit Windows 10 RCE

Also apart from the argument injection they found the next two attacks to be possible:

Although according to the MS Bounty program the findings could be qualified for the award of $50k instead they received only $5k. The company came up with a patch after 5 months but according to researchers` own words “failed to properly address the underlying argument injection”. The researchers say the exploit is also stil present on Windows 11 and considering how many URI handlers Windows has it may be possible that they are vulnerable too.