CVE-2020-0901: Microsoft 365 Apps RCE Vulnerability

CVE-2020-0901 Overview

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory. This memory corruption flaw allows attackers to execute arbitrary code in the context of the current user, potentially leading to complete system compromise. The vulnerability affects multiple versions of Microsoft Office and Microsoft 365 Apps, making it a significant threat to enterprise environments where Excel spreadsheets are commonly used for business operations.

Critical Impact

Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the current user, potentially leading to complete system compromise, data theft, and lateral movement within corporate networks.

Affected Products

• Microsoft 365 Apps
• Microsoft Office 2010 SP2
• Microsoft Office 2013 SP1 (including RT edition)
• Microsoft Office 2016 (Windows and macOS)
• Microsoft Office 2019 (Windows and macOS)

Discovery Timeline

• 2020-05-21 - CVE-2020-0901 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-0901

Vulnerability Analysis

This vulnerability stems from improper memory handling within Microsoft Excel when processing specially crafted spreadsheet files. When Excel attempts to parse certain objects within a malicious file, it fails to properly validate and manage memory operations, leading to a memory corruption condition that can be leveraged for code execution.

The attack can be carried out remotely without requiring any privileges or user interaction, as indicated by the network-based attack vector. An attacker could craft a malicious Excel file and deliver it via email, file sharing, or web download. When a victim opens the file, the vulnerability is triggered, allowing the attacker to execute code with the same privileges as the logged-in user.

The impact of successful exploitation is severe, with potential for full confidentiality, integrity, and availability compromise of the affected system.

Root Cause

The root cause of CVE-2020-0901 lies in Microsoft Excel's failure to properly handle objects in memory during file parsing operations. This memory management deficiency allows attackers to corrupt memory structures in a controlled manner, ultimately enabling arbitrary code execution. The specific CWE classification indicates this is a complex vulnerability without a single standardized weakness category.

Attack Vector

The vulnerability is exploited through network-based delivery of malicious Excel files. An attacker can craft a specially designed spreadsheet that, when opened by Microsoft Excel, triggers the memory corruption vulnerability.

The attack flow typically involves:

1. Attacker creates a malicious Excel file (.xlsx, .xlsm, .xls, or similar formats) containing specially crafted objects
2. The malicious file is delivered to victims via email attachments, compromised websites, file sharing services, or other distribution methods
3. When the victim opens the file with a vulnerable version of Microsoft Excel, the malicious objects trigger improper memory handling
4. The memory corruption allows the attacker to execute arbitrary code with the privileges of the current user
5. If the user has administrative privileges, the attacker gains full control of the system

Detection Methods for CVE-2020-0901

Indicators of Compromise

• Unexpected Excel processes spawning child processes (particularly cmd.exe, powershell.exe, or other shell interpreters)
• Excel files with suspicious embedded objects or macros received from unknown sources
• Unusual network connections originating from Excel processes
• Memory access violations or crash dumps related to EXCEL.EXE

Detection Strategies

• Monitor for Excel processes exhibiting abnormal behavior such as spawning shell processes or making network connections to external hosts
• Implement email gateway filtering to scan Excel attachments for known malicious patterns
• Deploy endpoint detection and response (EDR) solutions to detect memory corruption exploitation attempts
• Enable Windows Defender Exploit Guard to monitor for exploitation techniques

Monitoring Recommendations

• Configure SIEM rules to alert on Excel process anomalies, including unusual child process creation
• Monitor file system activity for Excel files downloaded from untrusted sources
• Track Microsoft Office update status across all endpoints to identify unpatched systems
• Review application logs for Excel crash events that may indicate exploitation attempts

How to Mitigate CVE-2020-0901

Immediate Actions Required

• Apply the Microsoft security update immediately to all affected Microsoft Office and Microsoft 365 Apps installations
• Enable Protected View for files originating from the internet, email, or other untrusted locations
• Disable macro execution or configure macro settings to block unsigned macros
• Educate users about the risks of opening Excel files from unknown or untrusted sources

Patch Information

Microsoft has released security updates to address this vulnerability. Organizations should apply patches from the Microsoft Security Advisory CVE-2020-0901 immediately. The patch addresses the improper memory handling in Microsoft Excel by implementing proper object validation and memory management controls.

For enterprise environments, use Windows Server Update Services (WSUS), Microsoft Endpoint Configuration Manager, or other patch management solutions to deploy updates across all affected systems. Prioritize patching for systems that regularly process Excel files from external sources.

Workarounds

• Enable Protected View in Microsoft Office settings to open files from untrusted sources in a sandboxed environment
• Configure Microsoft Office to block files downloaded from the internet using Group Policy
• Implement application whitelisting to prevent unauthorized code execution from Excel processes
• Use Microsoft Office Application Guard to isolate potentially malicious documents in a container

# Configuration example
# Enable Protected View via Registry for all Office applications
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachementsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f

# Block macros from files downloaded from the internet
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security" /v blockcontentexecutionfrominternet /t REG_DWORD /d 1 /f