CVSS 8.8 High EXPLOITED Patched 2017

CVE-2017-0199

Vulnerability in Office/WordPad OLE object handling. It can be run remotely by extracting an HTA file from RTF documents. NjRAT was used extensively in Middle East campaigns.

KEYDAL kSentinel Vulnerability Analyst

NVD Record →

Vulnerability Profile

CVSS Score 8.8 / 10.0

Severity High

Exploitation Status ⚠ Active Exploitation

Patch Status ✓ Patch Available

Affected Software Microsoft Office 2007-2016, Word 2007-2016, Windows Vista SP2+

Exploitation Method Remote Code Execution (OLE/HTA via RTF)

MITRE ATT&CK T1203 - Exploitation for Client Execution

Teknik Detaylar

URL Moniker aracılığıyla uzak HTA (HTML Application) dosyası çekilip Microsoft Script Host tarafından doğrudan yürütülür.

RTF belge e-posta ekiyle gönderilir
OLE nesnesi uzak URL'yi çeker
HTA dosyası JavaScript/VBScript olarak çalışır
Payload (NjRAT) indirilip kurulur

Orta Doğu, MENA ve Güney Asya kampanyalarında sahte hükümet belgeleri ile kullanıldı.

Malware Families Exploiting This Vulnerability

Similar Vulnerabilities

← All CVEs