In a company press release, Cymulate warns that the unpatched zero-day flaw requires no special configuration to reproduce and potentially affects all users of Office 2016 and older versions of the software suite.
Cymulate told SC Media that it disclosed the bug to Microsoft three months ago, noting however that the flaw did not qualify for an official CVE identifier.
According to Ben-Yossef, attackers can exploit the flaw by first embedding a video inside a Word document, then unpacking the doc in order to single out the file “document.xml.” Next, the factors can replace that XML file’s iframe code with a crafted payload. “Once run, this code will use the msSaveOrOpenBlob method to trigger the download of the executable by opening Internet Explorer Download Manager with the option to run or save the file,” the blog post states.
Using this exploit method, attacker could potentially trick users into installing a fake software update, Cymulate continues, noting that potential victims would receive no security warning when opening the sabotaged document.
In response to Cymulate’s claims, Jeff Jones, senior director at Microsoft told SC Media, “The product is properly interpreting html as designed — working in the same manner as similar products.”