# URI scheme handler without allowlist

User-influenced URI reaching an OS or app scheme handler without an explicit scheme allowlist

_Area: Memory corruption and native code. Seen in 2 disclosed reports; one confirmed bounty: $7,500; latest 2022-05-30. Updated 2026-11-08._

## How it works
A URL or document reference is passed to a scheme handler (steam://, ms-msdt:) that trusts its input. The assumption that breaks: the caller believes only safe schemes reach the handler, but the renderer or document format forwards any scheme through. The handler then acts on the URI's arguments, invoking the OS shell or PowerShell with attacker data [E1](https://bugbountylibrary.com/r/h1%3A409850.md)[E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-microsoft-office-remote-code-execution-follina-msdt-bug.md).

## Where it shows up
- Markup renderers turning user text into anchors/links without a scheme allowlist (BBCode [url], dangerouslySetInnerHTML) [E1](https://bugbountylibrary.com/r/h1%3A409850.md)
- Document external relationships (document.xml.rels) loading remote HTML that sets window.location to a custom scheme [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-microsoft-office-remote-code-execution-follina-msdt-bug.md)
- Registered protocol handlers that forward arguments to a shell or script engine (openexternalforpid, PCWDiagnostic/IT_BrowseForFile) [E1](https://bugbountylibrary.com/r/h1%3A409850.md)[E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-microsoft-office-remote-code-execution-follina-msdt-bug.md)
- Legacy res:// + javascript: sinks inside signed DLLs, reachable from unexpected file formats like MSC StringTables [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-grimresource.md)

## How to review
Find every place user-influenced text becomes a URI, and every handler that receives a URI. The invariant: before a URI reaches an OS/app handler, its scheme must be checked against an explicit allowlist, and handler arguments must not be interpreted as commands or paths. Check that the renderer strips all non-allowlisted schemes, not just javascript: [E1](https://bugbountylibrary.com/r/h1%3A409850.md); that document rels cannot load remote content that navigates to a scheme [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-microsoft-office-remote-code-execution-follina-msdt-bug.md); and that legacy res://+javascript: sinks are unreachable from file formats [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-grimresource.md).

## How finders spotted it
- Noticed chat used binary WebSocket and React; set breakpoints on dangerouslySetInnerHTML and XHR to trace BBCode rendering, found [url] accepted arbitrary schemes; javascript: was stripped, so pivoted to steam:// [E1](https://bugbountylibrary.com/r/h1%3A409850.md)
- Binary-grepped Steam for protocol strings, found openexternalforpid/%s/%s, then saw in the Steam console that jarfile: links were internally rewritten to steam://openexternalforpid/10400/..., revealing a privileged handler [E1](https://bugbountylibrary.com/r/h1%3A409850.md)
- Unzipped the docx, found the external rel to a remote HTML file, retrieved it, and minimized the trigger [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-microsoft-office-remote-code-execution-follina-msdt-bug.md)
- Observed a novel in-the-wild MSC sample and reverse-engineered the chain to the apds.dll res:// StringTable reference [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-grimresource.md)

## Variants seen
- BBCode link renderer plus desktop protocol handler with a magic PID [E1](https://bugbountylibrary.com/r/h1%3A409850.md)
- Office external relationship to remote HTML invoking ms-msdt: [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-microsoft-office-remote-code-execution-follina-msdt-bug.md)
- res:// + javascript: XSS inside a signed DLL reached from an MSC file [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-grimresource.md)

## Impact and severity
Reached remote code execution on victims in [E1](https://bugbountylibrary.com/r/h1%3A409850.md) and [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-microsoft-office-remote-code-execution-follina-msdt-bug.md); [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-microsoft-office-remote-code-execution-follina-msdt-bug.md) also enabled zero-click via RTF preview and NTLM hash leaks. [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-grimresource.md) gave code execution and evasion of static/behavioral detection. Impact rose when chained: renderer flaw to privileged handler [E1](https://bugbountylibrary.com/r/h1%3A409850.md), document open to shell [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-microsoft-office-remote-code-execution-follina-msdt-bug.md), legacy XSS to loader and injection [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-grimresource.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **Microsoft Word** (ms-msdt URL handler) (version not stated): Rapid Response: Microsoft Office RCE - “Follina” MSDT Attack (CVE-2022-30190). Report: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-microsoft-office-remote-code-execution-follina-msdt-bug.md

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A409850.md
- E2: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-microsoft-office-remote-code-execution-follina-msdt-bug.md
- E3: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-grimresource.md