# Rapid Response: Microsoft Office RCE - “Follina” MSDT Attack

MSDT URL scheme invoked from Word external rels executes PowerShell via IT_BrowseForFile, giving code execution on document open/preview.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft Office
- Credited: Huntress
- Disclosed: 2022-05-30
- CVE: CVE-2022-30190
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-microsoft-office-remote-code-execution-follina-msdt-bug
- Tags: domain:desktop impact:rce kind:incident platform:threat-intel sev:high tech:windows technique:chained technique:source-review vuln:command-injection vuln:rce

**Target:** Microsoft Word document / MSDT (ms-msdt) URL handler
**Root cause:** Word follows an external relationship to remote HTML which sets window.location.href to an ms-msdt: URI; the PCWDiagnostic handler passes IT_BrowseForFile into PowerShell, executing $(...) subexpressions.
**Steps:**
1. Unzip malicious .docx; observe word/_rels/document.xml.rels referencing external hxxps://www.xmlformats.com/.../RDF842l.html
2. Serve HTML >4096 bytes (padding required by hardcoded buffer) containing `location.href = "ms-msdt:/id PCWDiagnostic /skip force /param \"IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_BrowseForFile=/../../$(calc)/.exe\""`
3. Open document (or preview .rtf) to trigger ms-msdt handler
4. Confirm child process of msdt.exe / sdiagnhost.exe spawns payload
**How found:** Huntress obtained @nao_sec's sample, unzipped the docx, found the external rel to RDF842l.html, retrieved HTML from ANY.RUN, and noticed padding A-comments were required; community (Bill Demirkapi) explained the 4096-byte buffer, then they minimized the trigger.
**Exploitation:** Remote HTML delivered via Word external rel, invokes ms-msdt PCWDiagnostic with IT_BrowseForFile containing base64 PowerShell that kills msdt.exe, extracts a CAB from a RAR via certutil -decode and expand, then runs rgb.exe under the victim user.
**Escalation:** RTF preview pane enables zero-click trigger; remote payload fetch leaks NTLM hashes for post-exploitation; code runs as user then escalates.
**Insight:** Office external relationships (document.xml.rels) can load remote HTML that abuses registered URL protocol handlers; fuzz protocol handlers like ms-msdt with $(...) and directory traversal, and note hardcoded buffer minimums that force padding.