# Windows 10 RCE: The exploit is in the link

Argument injection in Windows 10/11 ms-officecmd: URI handler lets a malicious link launch MS Teams with --gpu-launcher, achieving drive-by RCE via IE11/Edge Legacy.

- Payout: $5,000
- Severity: critical
- Program: Microsoft
- Credited: Fabian Bräunlein, Lukas Euler
- Disclosed: 2021-12-07
- Write-up quality: 9/10
- Original: https://positive.security/blog/ms-officecmd-rce
- Library page: https://bugbountylibrary.com/r/blog%3Apositive-security-blog-ms-officecmd-rce
- Tags: domain:desktop impact:rce kind:bounty platform:blog sev:critical tech:electron technique:chained technique:reverse-engineering technique:source-review vuln:command-injection vuln:rce

**Target:** ms-officecmd: URI handler (LocalBridge.exe/AppBridge.dll) launching Office/Teams Electron apps
**Root cause:** LocalBridge.exe/AppBridge.dll pass the attacker-controlled JSON `filename` value into the launched application's command line without neutralizing quote/space sequences, allowing argument injection; Electron's CVE-2018-1000006 fix exempts 1-letter schemes like `a:/`, so injected Electron switches survive.
**Steps:**
1. Enumerate URI handlers via registry search for 'URL Protocol' under HKCR; identify ms-officecmd.
2. Trigger `ms-officecmd:invalid` and read Event Log .NET JsonReaderException to learn JSON structure.
3. Decompile LocalBridge.exe (dotPeek) and AppBridge.dll (Ghidra) to recover `LocalProviders.LaunchOfficeAppForResult` schema and `LaunchOfficeAppValidated`.
4. Debug Office UWP app via Edge DevTools Preview, breakpoint `launchViaProtocol`, extract real JSON payload (or use ProcMon Process Create events).
5. Confirm argument injection with `filename: "https://example.com/\" /q"` (double-quote + space breakout).
6. Build RCE payload: `filename: "a:/b/ --disable-gpu-sandbox --gpu-launcher=\"C:\\Windows\\System32\\cmd /c calc && \""` with appId 5 (Teams).
7. Deliver via HTML page with `<a href="ms-officecmd:{...}">` and `document.getElementById('l').click()`; IE11/Edge Legacy execute without prompt, other browsers show a confirmation dialog.
8. Bypass AppBridge.dll extension check by avoiding `.` (integer IP) or appending trailing `/`.
**How found:** Goal: find RCE in a default Windows URI handler. Enumerated handlers via registry 'URL Protocol' search; ms-officecmd looked promising due to Office complexity and 'cmd' name. Observed LocalBridge.exe spawn and JSON parse errors in Event Log, decompiled LocalBridge.exe/AppBridge.dll, then debugged the Office UWP app to recover the real JSON payload. Hypothesized filename is passed into a shell/argv and confirmed breakout with `" ` (quote+space).
**Exploitation:** Victim visits malicious page (IE11/Edge Legacy) or clicks a crafted ms-officecmd: link; LocalBridge.exe parses JSON and launches Teams with injected `--disable-gpu-sandbox --gpu-launcher="cmd /c <payload> && "`, executing arbitrary OS commands when the GPU process starts. Precondition: Teams installed but not running. Alternative payloads: `--host-rules`+`--ignore-certificate-errors` for Teams MITM/token theft, `--inspect=0.0.0.0:28966` for LAN debugger RCE, Outlook `C://...exe/` for download-and-execute.
**Escalation:** Chained argument injection with Electron CVE-2018-1000006 bypass (1-letter scheme exemption) and AppBridge extension-check bypass; extended from user-interaction RCE to drive-by via IE11/Edge Legacy, and to MITM/debugger-based RCE variants.
**Insight:** When a URI handler forwards a JSON field into a child process command line, test quote+space breakout; also check whether the target runtime's own CVE fix (e.g. Electron's post-URI argument drop) has carve-outs like 1-letter schemes (`a:/`) that re-enable injection.