According to a Microsoft on Tuesday, malicious actors are exploiting the CVE-2021-40444, a zero-day remote code execution vulnerability in MSHTML (the main HTML component of the Internet Explorer browser), to compromise Windows/Office users in a "limited number of targeted attacks."
See also: LockFile: The new ransomware targeting Microsoft Exchange servers
The current attacks were discovered by researchers at Microsoft, Mandiant , and Expmon, the latter of which says they have reliably replicated the attack on Windows 10.
Attackers drop specially crafted Microsoft Office documents on targets.
"An attacker could create a malicious ActiveX control for use by a Microsoft Office document that hosts the browser's rendering engine. The attacker would then have to convince the user to open the malicious document," Microsoft explained.
The company also noted that “Users whose accounts are configured to have fewer user rights on the system could be less affected than users operating with administrator rights,” and that Microsoft Office opens documents from the Internet in Protected View or Application Guard for Office by default, and that this prevents current attacks.
See also: Office 365: Administrators will block Active Content in Trusted Docs
Unfortunately, users are often tricked into opening documents from untrusted sources and exiting Protected View.
Until a patch is released, Microsoft recommends that administrators disable ActiveX in Internet Explorer to mitigate the risk (instructions on how to do this are included in the security advisory).
See also: Clippy: Microsoft "threatens" to resurrect him as an Office emoji
"At this point, disabling ActiveX should have very little impact, but of course, there may be individual business applications that still use ActiveX," noted Dr. Johannes Ullrich, Dean of Research at the SANS Technology Institute.
