CVE-2020-0980: Microsoft Office RCE Vulnerability

CVE-2020-0980 Overview

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. This memory corruption vulnerability allows attackers to execute arbitrary code in the context of the current user by convincing victims to open specially crafted Word documents. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system.

Critical Impact
Successful exploitation allows attackers to execute arbitrary code with the privileges of the current user, potentially leading to full system compromise, data theft, and lateral movement within enterprise networks.

Affected Products

Microsoft Word 2010 SP2, 2013 SP1, 2016
Microsoft Office 2010 SP2, 2016 (Mac), 2019
Microsoft Office 365 ProPlus
Microsoft Office Online Server
Microsoft Office Web Apps 2010 SP2, 2013 SP1
Microsoft SharePoint Enterprise Server 2013 SP1, 2016
Microsoft SharePoint Server 2010 SP2, 2019

Discovery Timeline

April 15, 2020 - CVE-2020-0980 published to NVD
November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-0980

Vulnerability Analysis

This vulnerability stems from improper memory handling within Microsoft Word's object processing routines. When Word parses certain document elements, specifically objects embedded within documents, the application fails to properly validate memory boundaries before performing operations on those objects. This memory corruption condition creates an exploitable state that attackers can leverage to achieve code execution.

The attack requires user interaction—specifically, a victim must open a malicious document. This could be delivered through phishing emails with malicious attachments, compromised file shares, or malicious websites offering document downloads. The vulnerability affects a wide range of Microsoft Office products including desktop applications, web-based services, and collaboration platforms like SharePoint.

Root Cause

The root cause is improper handling of objects in memory within Microsoft Word's document parsing engine. When processing specially crafted document structures, Word fails to properly validate object boundaries and memory allocations, leading to memory corruption that can be exploited for arbitrary code execution.

Attack Vector

The attack requires local access in the sense that a user must open a malicious document on their system. The typical attack flow involves:

Attacker crafts a malicious Word document containing specially formed objects designed to trigger the memory corruption
Document is delivered to victim via email attachment, shared drive, or download link
Victim opens the document in Microsoft Word or via browser-based Office applications
Memory corruption occurs during document parsing
Attacker's payload executes with the privileges of the current user

The vulnerability can be exploited through various Microsoft Office components including standalone Word, Office Web Apps, Office Online Server, and SharePoint Server installations that process Word documents.

Detection Methods for CVE-2020-0980

Indicators of Compromise

Suspicious Word document files (.doc, .docx, .rtf) received via email from unknown senders or unexpected sources
Microsoft Word processes (WINWORD.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, or mshta.exe
Unusual network connections originating from Word processes indicating potential command and control communication
Crash dumps or Windows Error Reporting events for Word processes that may indicate exploitation attempts

Detection Strategies

Deploy endpoint detection and response (EDR) solutions to monitor for suspicious process chains originating from Office applications
Implement email gateway scanning to detect potentially malicious document attachments before delivery
Enable Microsoft Office Protected View and Application Guard to execute documents in sandboxed environments
Monitor for behavioral indicators such as Office applications making network connections or spawning shell processes

Monitoring Recommendations

Enable Windows Event logging for process creation events (Event ID 4688) with command-line auditing to track suspicious process hierarchies
Configure SIEM alerts for Office applications spawning script interpreters or making outbound network connections
Monitor file system activity for documents being opened from suspicious locations such as temp directories or user download folders
Implement document telemetry to track Office document opens across the organization

How to Mitigate CVE-2020-0980

Immediate Actions Required

Apply the Microsoft security update immediately to all affected systems and Office installations
Enable Protected View in Microsoft Office to open potentially dangerous documents in a sandboxed read-only mode
Implement email filtering to block or quarantine suspicious Office document attachments
Educate users about the risks of opening documents from untrusted sources
Consider deploying Microsoft Defender Application Guard for Office where supported

Patch Information

Microsoft has released security updates addressing this vulnerability. Administrators should apply the appropriate patches from the Microsoft Security Advisory CVE-2020-0980. Updates are available through Windows Update, Microsoft Update Catalog, and WSUS for enterprise deployments. Organizations running SharePoint Server or Office Web Apps should also apply the corresponding server-side patches.

Workarounds

Configure Microsoft Office to open documents from the Internet in Protected View by enabling appropriate trust center settings
Use Attack Surface Reduction (ASR) rules to block Office applications from creating child processes
Restrict the ability for Office applications to make outbound network connections via firewall policies
Consider using Office 365 with cloud-based document inspection before documents reach user endpoints

bash

# Enable ASR rule to block Office applications from creating child processes
# Run in elevated PowerShell
Add-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions Enabled

# Verify ASR rule is enabled
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions