SSD Advisory – Microsoft Office SMB Information Disclosure

Vulnerability Summary
The following advisory describes an information disclosure found in Microsoft Office versions 2010, 2013, and 2016.

Microsoft Office is: “Whether you’re working or playing, Microsoft is here to help. We’re the company that created Microsoft Office, including Office 365 Home, Office 365 Personal, Office Home & Student 2016, Office Home & Business 2016, and Office Professional 2016. You can also get Office for Mac. Whatever your needs—whether professional or simply for fun—we’ve got you covered. The powerful software in Microsoft Office 2013 remains in Microsoft Office 2016.”

Credit
An independent security researcher, Björn Ruytenberg, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

Vendor response
Microsoft was informed of the vulnerability, to which they response with:

“Upon investigation, we have determined that this submission does not meet the bar for security servicing. Unfortunately images are commonly used in emails and other locations that are sourced from external sites, those sites can use that request for basic tracking information. Your report about SMBTrap is also a well documented publicly disclosed item and would not meet the bar. In addition the PoC requires a user to disable their security, specifically the Protected View, stating that they trust the source.

As such, this email thread has been closed and will no longer be monitored.”

Vulnerability details
The Microsoft Office document format allows for embedding remote content, such as images. This remote content can be hosted on any HTTP server. Upon opening such a document, embedded remote content is downloaded and shown. A vulnerability exists that enables exploiting this mechanism to disclose information to an attacker-controlled remote server.

An attacker can send to the victim a malicious Office file with embedded remote content.

When the victim will open the file, an HTTP request will be sent to the attacker controlled web-server.

The vulnerability allows the attacker to redirect the HTTP request to an SMB connection an get the following information from the victims machine:

• Victim host environment information
• Host IP address (*)
• Windows version
• Office version
• Installed .NET Framework runtimes
• Presence of the Tablet PC subsystem (**)
• Windows user credentials: username and password NTLM hash. This allows an attacker to:

1. Mount a “Pass-the-Hash” attack: the username and hash can be used to logon to a third-party host that the victim is authorized to access.
2. Derive the originating plaintext password, using bruteforcing tools (***)

(*) The IP address exposed to the attacker’s server depends on the document payload. If the payload references an external host, i.e. outside the local network, the victim host’s external IP address will be exposed to the attacker server. Similarly, if referencing an internal server, the victim host’s internal IP address will be exposed to the attacker server.
(**) If present, the Tablet PC substring likely indicates that the victim’s machine is a tablet device, or hybrid equipment that provides a touch screen.
(***) The Exploit section further discusses these scenarios.

The vulnerability can be exploited through:

• Opening a specially-crafted, local MS Office document (DOCX, XLSX) that embeds the malicious content. No additional user interaction is required.
• Opening a specially-crafted MS Office document, downloaded from a remote server. In this scenario, disabling “Protected View”, i.e. clicking “Enable Editing”, is required to exploit the vulnerability. However, enabling macros is _not_ required.

Proof of Concept
Attacker Webserver: