CVE-2020-0980: Microsoft Office RCE Vulnerability

CVE-2020-0980 Overview

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. This memory corruption vulnerability allows attackers to execute arbitrary code in the context of the current user by convincing victims to open specially crafted Word documents. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system.

Critical Impact

Successful exploitation allows attackers to execute arbitrary code with the privileges of the current user, potentially leading to full system compromise, data theft, and lateral movement within enterprise networks.

Affected Products

• Microsoft Word 2010 SP2, 2013 SP1, 2016
• Microsoft Office 2010 SP2, 2016 (Mac), 2019
• Microsoft Office 365 ProPlus
• Microsoft Office Online Server
• Microsoft Office Web Apps 2010 SP2, 2013 SP1
• Microsoft SharePoint Enterprise Server 2013 SP1, 2016
• Microsoft SharePoint Server 2010 SP2, 2019

Discovery Timeline

• April 15, 2020 - CVE-2020-0980 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-0980

Vulnerability Analysis

This vulnerability stems from improper memory handling within Microsoft Word's object processing routines. When Word parses certain document elements, specifically objects embedded within documents, the application fails to properly validate memory boundaries before performing operations on those objects. This memory corruption condition creates an exploitable state that attackers can leverage to achieve code execution.

The attack requires user interaction—specifically, a victim must open a malicious document. This could be delivered through phishing emails with malicious attachments, compromised file shares, or malicious websites offering document downloads. The vulnerability affects a wide range of Microsoft Office products including desktop applications, web-based services, and collaboration platforms like SharePoint.

Root Cause

The root cause is improper handling of objects in memory within Microsoft Word's document parsing engine. When processing specially crafted document structures, Word fails to properly validate object boundaries and memory allocations, leading to memory corruption that can be exploited for arbitrary code execution.

Attack Vector

The attack requires local access in the sense that a user must open a malicious document on their system. The typical attack flow involves:

1. Attacker crafts a malicious Word document containing specially formed objects designed to trigger the memory corruption
2. Document is delivered to victim via email attachment, shared drive, or download link
3. Victim opens the document in Microsoft Word or via browser-based Office applications
4. Memory corruption occurs during document parsing
5. Attacker's payload executes with the privileges of the current user

The vulnerability can be exploited through various Microsoft Office components including standalone Word, Office Web Apps, Office Online Server, and SharePoint Server installations that process Word documents.

Detection Methods for CVE-2020-0980

Indicators of Compromise

• Suspicious Word document files (.doc, .docx, .rtf) received via email from unknown senders or unexpected sources
• Microsoft Word processes (WINWORD.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, or mshta.exe
• Unusual network connections originating from Word processes indicating potential command and control communication
• Crash dumps or Windows Error Reporting events for Word processes that may indicate exploitation attempts

Detection Strategies

• Deploy endpoint detection and response (EDR) solutions to monitor for suspicious process chains originating from Office applications
• Implement email gateway scanning to detect potentially malicious document attachments before delivery
• Enable Microsoft Office Protected View and Application Guard to execute documents in sandboxed environments
• Monitor for behavioral indicators such as Office applications making network connections or spawning shell processes

Monitoring Recommendations

• Enable Windows Event logging for process creation events (Event ID 4688) with command-line auditing to track suspicious process hierarchies
• Configure SIEM alerts for Office applications spawning script interpreters or making outbound network connections
• Monitor file system activity for documents being opened from suspicious locations such as temp directories or user download folders
• Implement document telemetry to track Office document opens across the organization

How to Mitigate CVE-2020-0980

Immediate Actions Required

• Apply the Microsoft security update immediately to all affected systems and Office installations
• Enable Protected View in Microsoft Office to open potentially dangerous documents in a sandboxed read-only mode
• Implement email filtering to block or quarantine suspicious Office document attachments
• Educate users about the risks of opening documents from untrusted sources
• Consider deploying Microsoft Defender Application Guard for Office where supported

Patch Information

Microsoft has released security updates addressing this vulnerability. Administrators should apply the appropriate patches from the Microsoft Security Advisory CVE-2020-0980. Updates are available through Windows Update, Microsoft Update Catalog, and WSUS for enterprise deployments. Organizations running SharePoint Server or Office Web Apps should also apply the corresponding server-side patches.

Workarounds

• Configure Microsoft Office to open documents from the Internet in Protected View by enabling appropriate trust center settings
• Use Attack Surface Reduction (ASR) rules to block Office applications from creating child processes
• Restrict the ability for Office applications to make outbound network connections via firewall policies
• Consider using Office 365 with cloud-based document inspection before documents reach user endpoints

# Enable ASR rule to block Office applications from creating child processes
# Run in elevated PowerShell
Add-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions Enabled

# Verify ASR rule is enabled
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions