PT-2017-1874 · Microsoft · Windows Server+3

Published 2017-04-11 · Updated 2026-06-10 · CVE-2017-0199

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office 2007 SP3 Microsoft Office 2010 SP2 Microsoft Office 2013 SP1 Microsoft Office 2016 Microsoft Windows Vista SP2 Windows Server 2008 SP2 Windows 7 SP1 Windows 8.1

Description A remote code execution issue exists in the way Microsoft Office and WordPad parse specially crafted files. This flaw is related to access control deficiencies and the loading of DLLs (Dynamic Link Libraries), which are shared libraries used by multiple programs. An attacker can exploit this by inducing a user to open or preview a crafted document, such as a DOCX file, which may trigger the formula editor to request a remote HTML application file. Successful exploitation allows a remote attacker to execute arbitrary code, take full control of the affected system, install programs, view, modify, or delete data, and create new accounts with full user rights. This issue has been utilized in targeted campaigns, such as Operation FrostBeacon, to deliver Cobalt Strike Beacons to financial and legal organizations via phishing emails.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2017-01034

CVE-2017-0199

Affected Products

Office

Windows

Windows Server

Wordpad

References · 130

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/office_word_hta.rb · Exploit
• 🔥 https://github.com/qazbnm456/awesome-cve-poc/blob/master/CVE-2017-0199.md · Exploit
• 🔥 https://github.com/bhdresh/CVE-2017-0199 · Exploit
• 🔥 https://github.com/haibara3839/CVE-2017-0199-master · Exploit
• 🔥 https://github.com/SyFi/cve-2017-0199 · Exploit
• 🔥 https://github.com/Exploit-install/CVE-2017-0199 · Exploit
• 🔥 https://github.com/NotAwful/CVE-2017-0199-Fix · Exploit
• 🔥 https://github.com/n1shant-sinha/CVE-2017-0199 · Exploit
• 🔥 https://github.com/kn0wm4d/htattack · Exploit
• 🔥 https://github.com/Sunqiz/CVE-2017-0199-reprofuction · Exploit
• 🔥 https://github.com/herbiezimmerman/2017-11-17-Maldoc-Using-CVE-2017-0199 · Exploit
• 🔥 https://github.com/nicpenning/RTF-Cleaner · Exploit
• 🔥 https://github.com/jacobsoo/RTF-Cleaner · Exploit
• 🔥 https://fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html · Exploit
• 🔥 https://exploit-db.com/exploits/41934 · Exploit