[Since it’s initial publication, this article has been updated] Sophos has released details of a novel exploit that bypasses a patch for a critical vulnerability (CVE-2021-40444) affecting the Microsoft Office file format.
The findings are reported in a SophosLabs Uncut article, “Attackers test ‘CAB-less 40444’ exploit in a dry run,” that shows how the attackers took a publicly available proof-of-concept Office exploit and weaponised it to deliver Formbook malware.
The attackers then distributed it through spam emails for approximately 36 hours before it disappeared, according to Sophos researchers.
From CAB to “CAB-less” Exploit
In September 2021, Microsoft released a patch to prevent attackers from executing malicious code embedded in a Word document that downloads a Microsoft Cabinet (CAB) archive, which, in turn, contains a malicious executable. Sophos researchers discovered that attackers have reworked the original exploit by placing the malicious Word document inside a specially crafted RAR archive. The newer, “CAB-less” form of the exploit successfully evades the original patch.
Sophos data shows that the amended exploit was used in the wild for around 36 hours. According to Sophos researchers, the limited lifespan of the updated attack could mean it was a “dry run” experiment that might return in future incidents.
“In theory, this attack approach shouldn’t have worked, but it did,” says Andrew Brandt, principal threat researcher at Sophos. “The pre-patch versions of the attack involved malicious code packaged into a Microsoft Cabinet file.
“When Microsoft’s patch closed that loophole, attackers discovered a proof-of-concept that showed how you could bundle the malware into a different compressed file format, a RAR archive. RAR archives have been used before to distribute malicious code, but the process used here was unusually complicated.
“It likely succeeded only because the patch’s remit was very narrowly defined and because the WinRAR program that users need to open the RAR is very fault tolerant and doesn’t appear to mind if the archive is malformed, for example, because it’s been tampered with.”
The Infection Chain
Sophos researchers found that the attackers had created an abnormal RAR archive that had a PowerShell script prepending a malicious Word document stored inside the archive.
The attackers created and distributed spam emails that included the malformed RAR file as an attachment. The emails invited recipients to uncompress the RAR file to access the Word document. Opening the Word document triggered a process that ran the front-end script, leading eventually to an infection with Formbook malware.
“This research is a reminder that patching alone cannot protect against all vulnerabilities in all cases,” says Brandt. “Setting restrictions that prevent a user from accidentally triggering a malicious document helps, but people can still be lured into clicking the ‘enable content’ button. It is therefore vitally important to educate employees and remind them to be suspicious of emailed documents, especially when they arrive in unusual or unfamiliar compressed file formats from people or companies they don’t know. If in doubt, always check with the sender or someone in IT.”
The CVE-2021-40444 vulnerability is a critical remote code execution (RCE) vulnerability that attackers can exploit to execute any code or commands on a target machine without the owner’s knowledge. Microsoft released an urgent mitigation followed by a patch in September. Sophos researchers found the 36 hours-campaign featuring the new exploit in late October.
UPDATE
A previous version of this story stated that the malformed RAR archive could not be opened in an earlier build of the WinRAR archiver. We have updated the story to explain how the RAR5 standard has changed and that WinRAR and other archiving tools now treat data preceding the Rar! magic bytes as if the archive contained self-extracting code. We have also tested the exploit on a testbed that has had the September, 2021 Cumulative Update, and while the Word document still was able to make a connection attempt, the remainder of the attack would not have completed due to the patch. We are unable to fully test this, because the malicious website hosting the exploit code has been shut down. We have added the label “[Updated]” to paragraphs that have been corrected. We apologize for giving a misleading impression that the exploit fully functions on a computer with the September (or later) Cumulative Updates installed.]
UPDATE
An earlier version of this post suggested the CAB-less exploit shown here works on systems that have the September 2021 patch for CVE-2021-40444. That is not the case; the patch corrected the issue. The attack was only successful on unpatched Windows systems. Thanks to Mitja Kolsek of ACROS Security and Will Dormann at CERT/CC for pointing out the error.]