Microsoft Word (2016) Deceptive File Reference ZDI-CAN-7949

[apparitionsec@xxxxxxxxx]

[+] Credits: John Page (aka hyp3rlinx)          
[+] Website: hyp3rlinx.altervista.org
[+] Source:  
http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WORD-DECEPTIVE-FILE-REFERENCE.txt
[+] ISR: ApparitionSec
[+] Zero Day Initiative Program        
 

[Vendor]
www.microsoft.com


[Product]
Microsoft Word 2016


[Vulnerability Type]
Deceptive File Reference


[References]
ZDI-CAN-7949


[Security Issue]
When a MS Word ".docx" File contains a hyperlink to another file, it will run 
the first file it finds in that directory with a
valid extension. But will present to the end user an extension-less file in its 
Security warning dialog box without showing the extension type.
If another "empty" file of the same name as the target executable exists but 
has no file extension. Because the extension is supressed it
makes the file seem harmless and the file can be masked to appear as just a 
folder etc.

This can potentially trick user into running unexpected code, but will only 
work when you have an additional file of same name with
NO extension on it.


[Exploit/POC]
1) Create a directory "PoC"

2) Create a folder in PoC directory named "Downloads Folder"

3) Create a .BAT file named "Downloads Folder.bat"

in the .BAT create some command like "start calc.exe"

4) Create an empty file named "Downloads Folder" with no file extension

5) Create the Word ".docx" file with a hyperlink pointing to "PoC/Downloads 
Folder/Downloads Folder"

Upon opening the link Word will give user an vague dialog box about asking if 
they want to open
the file. However, the prompt shows an apparent folder structure and no file 
extension .exe, .com etc
are visible or displayed to the end user.

Click the link to open what looks to be a folder then BOOM! the .BAT file runs 
instead.

Of course any exeuctable will do .EXE etc.


[Network Access]
Local


[Severity]
High


[POC Video URL]
https://www.youtube.com/watch?v=irxkV_qGG9Y


[Disclosure Timeline]
Notification: Trend Micro Zero Day Initiative Program : 2019-01-25

Case officially contracted to ZDI : 2019-02-06

Vendor Disclosure : 2019-02-15
submitted to the vendor as ZDI-CAN-7949.

ZDI Response : "We have synced with the vendor and they have resolved that this 
case
does not meet the bar for security servicing. Therefore we will proceed to 
close it on our end."

2019-06-14 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no 
warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided 
that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in 
vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the 
information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author 
prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx