CVE-2020-0760: Microsoft Access RCE Vulnerability

CVE-2020-0760 Overview

A remote code execution vulnerability exists in Microsoft Office due to improper handling of arbitrary type libraries. When Microsoft Office loads type libraries from untrusted sources, an attacker can exploit this weakness to execute malicious code in the context of the current user. This vulnerability is distinct from CVE-2020-0991 but shares a similar attack surface related to Office's handling of external resources.

Critical Impact

Successful exploitation allows attackers to execute arbitrary code with the privileges of the current user, potentially leading to complete system compromise, data theft, or lateral movement within an organization.

Affected Products

• Microsoft Office 2010 SP2, 2013 SP1, 2016, and 2019
• Microsoft Office 365 ProPlus
• Microsoft Access 2010 SP2, 2013 SP1, and 2016
• Microsoft Excel 2010 SP2, 2013 SP1, and 2016
• Microsoft Outlook 2010 SP2, 2013 SP1, and 2016
• Microsoft PowerPoint 2010 SP2, 2013 SP1, and 2016
• Microsoft Project 2010 SP2, 2013 SP1, and 2016
• Microsoft Publisher 2010 SP2, 2013 SP1, and 2016
• Microsoft Visio 2010 SP2, 2013 SP1, and 2016
• Microsoft Word 2010 SP2, 2013 SP1, and 2016

Discovery Timeline

• April 15, 2020 - CVE-2020-0760 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-0760

Vulnerability Analysis

This vulnerability stems from Microsoft Office's improper handling of type library loading operations. Type libraries (TLB files) are binary files that describe COM interfaces and are typically used for automation and interoperability. When Office applications process documents containing references to external type libraries, the application fails to properly validate the source and content of these libraries before loading them.

The vulnerability requires user interaction—specifically, a user must open a malicious document or click a crafted link. Once triggered, the attacker-controlled type library is loaded and executed within the Office process context, enabling arbitrary code execution.

Root Cause

The root cause lies in insufficient validation of type library sources during the loading process. Microsoft Office components trust and load type libraries from remote or untrusted locations without proper security checks. This allows attackers to craft documents that reference malicious type libraries hosted on attacker-controlled servers or embedded within the document itself.

The improper trust model for type library loading represents a design flaw in how Office handles COM automation resources, particularly when documents reference external components that should be subject to stricter security validation.

Attack Vector

The attack leverages the network vector, where an attacker crafts a malicious Office document containing references to attacker-controlled type libraries. The attack flow proceeds as follows:

1. The attacker creates a specially crafted Office document (Word, Excel, PowerPoint, etc.) that references a malicious type library
2. The document is delivered to the victim via email, web download, or file share
3. When the victim opens the document, Office attempts to load the referenced type library
4. Due to improper validation, the malicious type library is loaded and its code executes with the user's privileges

The attack requires user interaction (opening the malicious document) but no additional privileges. In enterprise environments where users commonly receive and open Office documents, this creates significant exposure to social engineering-based attacks.

Detection Methods for CVE-2020-0760

Indicators of Compromise

• Unexpected network connections from Office applications (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, etc.) to external servers attempting to retrieve .tlb or .olb files
• Office processes loading type libraries from unusual locations such as temp directories, user-writable paths, or remote UNC paths
• Suspicious Office documents with embedded or referenced type library objects from untrusted sources
• Process injection or child process spawning from Office applications following document opening

Detection Strategies

• Monitor process creation events for Office applications spawning unexpected child processes, particularly command interpreters or scripting engines
• Implement network traffic analysis to detect Office processes making outbound connections to retrieve type library files
• Deploy endpoint detection rules to identify type library loading from non-standard directories or remote locations
• Analyze Office document metadata and embedded objects for suspicious type library references before delivery to end users

Monitoring Recommendations

• Enable detailed logging for Office applications, including file access and network activity
• Configure SIEM rules to alert on Office applications loading libraries from temp directories, user profile locations, or network paths
• Implement sandboxing for document preview to identify malicious behavior before user interaction
• Monitor Windows Event Logs for COM/OLE-related errors or warnings originating from Office processes

How to Mitigate CVE-2020-0760

Immediate Actions Required

• Apply Microsoft security updates released in the April 2020 Patch Tuesday cycle immediately across all affected systems
• Enable Protected View for documents originating from the internet or untrusted sources
• Configure Office Trust Center settings to disable automatic loading of external content
• Restrict user privileges following the principle of least privilege to limit the impact of successful exploitation

Patch Information

Microsoft addressed this vulnerability in the April 2020 security updates. The fix implements proper validation of type library sources before loading, preventing the execution of arbitrary code through malicious type libraries.

For detailed patch information and download links, refer to the Microsoft Security Advisory CVE-2020-0760.

Organizations should prioritize patching the following product versions:

• Microsoft Office 2010 SP2, 2013 SP1, 2016, and 2019
• Microsoft Office 365 ProPlus
• All standalone Office applications (Access, Excel, Outlook, PowerPoint, Project, Publisher, Visio, Word)

Workarounds

• Enable Protected View in Office Trust Center settings to open potentially dangerous documents in a restricted mode that prevents type library loading
• Block outbound network connections from Office applications to untrusted destinations using application-aware firewalls
• Configure Group Policy to restrict Office applications from loading type libraries from remote or non-standard locations
• Implement Attack Surface Reduction (ASR) rules in Windows Defender to block Office applications from creating child processes or loading external content

# PowerShell: Enable Protected View for all file origins
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" -Name "DisableInternetFilesInPV" -Value 0
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableInternetFilesInPV" -Value 0
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" -Name "DisableInternetFilesInPV" -Value 0