Code Injection in Microsoft products - CVE-2021-40444
Published: September 7, 2021 / Updated: December 19, 2021
Vulnerability identifier: #VU56377
CSH Severity: Critical
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-40444
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation within the MSHTML component. A remote attacker can create a specially crafted Office document with a malicious ActiveX control inside, trick the victim into opening the document and execute arbitrary code on the system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note, the vulnerability is being actively exploited in the wild.
Affected software
Microsoft Windows
Windows Server
Microsoft Internet Explorer
Solutions Enabler Virtual Appliance
Solutions Enabler
Unisphere 360
Unisphere for PowerMax Virtual Appliance
Unisphere for PowerMax
VASA Provider Standalone
Windows Server
Microsoft Internet Explorer
Solutions Enabler Virtual Appliance
Solutions Enabler
Unisphere 360
Unisphere for PowerMax Virtual Appliance
Unisphere for PowerMax
VASA Provider Standalone
How to mitigate CVE-2021-40444
Install update from vendor's website.
Solutions Enabler Virtual Appliance - addressed in versions 9.1.0.18, 9.2.3.0
Solutions Enabler - addressed in versions 9.1.0.18, 9.2.3.0
Unisphere 360 - addressed in versions 9.1.0.29, 9.2.3.3
Unisphere for PowerMax Virtual Appliance - addressed in versions 9.1.0.31, 9.2.3.4
Unisphere for PowerMax - addressed in versions 9.1.0.31, 9.2.3.4
VASA Provider Standalone - addressed in versions 9.1.0.723, 9.2.3.0
Solutions Enabler - addressed in versions 9.1.0.18, 9.2.3.0
Unisphere 360 - addressed in versions 9.1.0.29, 9.2.3.3
Unisphere for PowerMax Virtual Appliance - addressed in versions 9.1.0.31, 9.2.3.4
Unisphere for PowerMax - addressed in versions 9.1.0.31, 9.2.3.4
VASA Provider Standalone - addressed in versions 9.1.0.723, 9.2.3.0
Links to Public Exploits and PoC-codes
- Exploit #7185 - Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit (CVE-2021-40444) (December 19, 2021)
- Exploit #7122 - Microsoft Office Word Malicious MSHTML RCE (December 9, 2021)
- Exploit #7096 - CVE-2021-40444-exp () (November 29, 2021)
- Exploit #7004 - word_mshtml (Contains the offensive (exploit and auxiliary) modules for the CVE-2021-40444.) (November 11, 2021)
- Exploit #6955 - CVE-2021-40444-POC (An attempt to reproduce Microsoft MSHTML Remote Code Execution (RCE) Vulnerability and using Metasploit Framework.) (October 29, 2021)
- Exploit #6943 - CVE-2021-40444 () (October 26, 2021)
- Exploit #6904 - TIC4301_Project (TIC4301 Project - CVE-2021-40444) (October 18, 2021)
- Exploit #6894 - CVE-2021-40444-docx-Generate () (October 18, 2021)
- Exploit #6812 - CVE-2021-40444 () (October 3, 2021)
- Exploit #6802 - Docx-Exploit-2021 (This docx exploit uses res files inside Microsoft .docx file to execute malicious files. This exploit is related to CVE-2021-40444) (September 29, 2021)
- Exploit #6791 - CVE-2021-40444_CAB_archives (CVE 2021 40444 Windows Exploit services.dll) (September 25, 2021)
- Exploit #6773 - CVE-2021-40444--CABless (Modified code so that we don´t need to rely on CAB archives) (September 21, 2021)
- Exploit #6768 - MSHTML-CVE-2021-40444 () (September 19, 2021)
- Exploit #6762 - CVE-2021-40444 (CVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit) (September 16, 2021)
- Exploit #6760 - CVE-2021-40444-URL-Extractor (Python script to extract embedded URLs from doc files (.docx, .docm, .rtf)) (September 16, 2021)
- Exploit #6759 - CVE-2021-40444-CAB (CVE-2021-40444 - Custom CAB templates from MakeCAB) (September 16, 2021)
- Exploit #6748 - CVE-2021-40444 (partly working PoC, check lockedbytes PoC for full experience!) (September 14, 2021)
- Exploit #6747 - cve-2021-40444-analysis () (September 14, 2021)
- Exploit #6746 - CVE-2021-40444_EXP_JS (根据已知样本反编译代码) (September 14, 2021)
- Exploit #6744 - CVE2021-40444 () (September 14, 2021)
- Exploit #6743 - CVE-2021-40444 () (September 14, 2021)
- Exploit #6735 - Exploit-PoC-CVE-2021-40444-inject-ma-doc-vao-docx () (September 12, 2021)
- Exploit #6734 - CVE-2021-40444 (CVE-2021-40444 Microsoft MSHTML Remote Code Execution Vulnerability) (September 12, 2021)
- Exploit #6733 - CVE-2021-40444-Sample (CVE-2021-40444 Sample ) (September 12, 2021)
- Exploit #6732 - CVE-2021-40444_builders (This repo contain builders of cab file, html file, and docx file for CVE-2021-40444 exploit) (September 12, 2021)
- Exploit #6731 - CVE-2021-40444-POC () (September 12, 2021)
- Exploit #6726 - CVE-2021-40444-docx-Generate () (September 12, 2021)
- Exploit #6725 - MSHTMHell (Malicious document builder for CVE-2021-40444 ) (September 12, 2021)
- Exploit #6724 - cve-2021-40444 (Reverse engineering the "A Letter Before Court 4.docx" malicious files exploting cve-2021-40444) (September 12, 2021)
- Exploit #6720 - Caboom (A malicious .cab creation tool for CVE-2021-40444) (September 12, 2021)
- Exploit #6719 - CVE-2021-40444-docx-Generate () (September 12, 2021)
- Exploit #6718 - CVE-2021-40444 (CVE-2021-40444 PoC) (September 12, 2021)