CVE-2021-27055: Microsoft Visio Auth Bypass Vulnerability

CVE-2021-27055 Overview

CVE-2021-27055 is a security feature bypass vulnerability affecting Microsoft Visio and related Microsoft Office products. This vulnerability allows attackers to circumvent security protections in affected Visio installations, potentially enabling further exploitation or unauthorized access to protected functionality.

Critical Impact

This security feature bypass vulnerability could allow attackers to circumvent intended security restrictions in Microsoft Visio, potentially leading to high impact on confidentiality, integrity, and availability of affected systems.

Affected Products

• Microsoft 365 Apps for Enterprise
• Microsoft Office 2019
• Microsoft Visio 2010 SP2
• Microsoft Visio 2013 SP1
• Microsoft Visio 2016

Discovery Timeline

• 2021-03-11 - CVE-2021-27055 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-27055

Vulnerability Analysis

This vulnerability represents a security feature bypass in Microsoft Visio that enables attackers to circumvent protective mechanisms within the application. The attack requires local access and depends on user interaction, such as opening a specially crafted Visio file. While exploitation complexity is considered high, successful attacks can result in significant impact across confidentiality, integrity, and availability of the affected system.

The vulnerability exists within Microsoft Visio's handling of certain file operations or security validation processes. An attacker who successfully exploits this vulnerability could bypass security features designed to protect users from malicious content, potentially opening pathways to further system compromise.

Root Cause

The vulnerability stems from improper security feature implementation in Microsoft Visio. The exact technical mechanism has not been publicly disclosed by Microsoft, as is typical for this vendor. The CWE classification indicates insufficient information has been released about the specific weakness type, though the impact suggests a flaw in how security controls are enforced during file processing or content validation.

Attack Vector

The attack vector for CVE-2021-27055 is local, meaning an attacker must have some level of access to the target system or convince a user to interact with malicious content. Typical exploitation scenarios include:

1. Malicious File Delivery: An attacker crafts a specially designed Visio file (.vsd, .vsdx, or related formats) and delivers it to the target via email attachment, file share, or download link.

2. User Interaction Required: The victim must open the malicious file in an affected version of Microsoft Visio.

3. Security Bypass Execution: Upon opening, the vulnerability is triggered, bypassing security features that would normally protect against malicious content execution.

The exploitation requires high complexity, suggesting that specific conditions must be met for successful exploitation. However, no user privileges are required from the attacker's perspective beyond convincing the user to open the crafted file.

Detection Methods for CVE-2021-27055

Indicators of Compromise

• Suspicious Visio files (.vsd, .vsdx, .vstx, .vstm) received from unknown or unexpected sources
• Unusual process behavior spawned from VISIO.EXE after opening files
• Unexpected network connections or file system modifications following Visio file operations
• Security software alerts related to Visio file processing

Detection Strategies

• Monitor for unusual child processes spawned by Microsoft Visio (VISIO.EXE)
• Implement email filtering rules to scan Visio file attachments for malicious indicators
• Deploy endpoint detection and response (EDR) solutions to monitor Visio application behavior
• Enable Windows Defender Application Guard for Office to isolate potentially malicious documents

Monitoring Recommendations

• Enable detailed logging for Microsoft Office applications including Visio
• Monitor Windows Event Logs for application crashes or unusual behavior related to Visio
• Implement file integrity monitoring on systems where Visio is installed
• Track and alert on Visio files downloaded from external sources or email attachments

How to Mitigate CVE-2021-27055

Immediate Actions Required

• Apply the latest security updates from Microsoft for all affected products
• Ensure Microsoft 365 Apps and Office installations are configured for automatic updates
• Train users to exercise caution when opening Visio files from untrusted sources
• Consider blocking Visio file attachments in email until patches are applied

Patch Information

Microsoft has released security updates addressing this vulnerability. Detailed patch information and guidance are available in the Microsoft Security Advisory CVE-2021-27055. Organizations should apply the March 2021 security updates for the following products:

• Microsoft 365 Apps for Enterprise
• Microsoft Office 2019
• Microsoft Visio 2010 SP2
• Microsoft Visio 2013 SP1
• Microsoft Visio 2016

Updates can be deployed through Windows Update, Microsoft Update Catalog, Windows Server Update Services (WSUS), or Microsoft Endpoint Configuration Manager.

Workarounds

• Enable Protected View for files originating from the Internet in Microsoft Office Trust Center settings
• Configure Microsoft Office to open files in read-only mode by default from untrusted locations
• Use Application Guard for Office to isolate potentially dangerous Visio files in a sandboxed container
• Implement strict email attachment policies to quarantine Visio files for scanning before delivery

# Enable Protected View via Group Policy
# Navigate to: User Configuration > Administrative Templates > Microsoft Visio 2016 > Visio Options > Security > Trust Center
# Enable: "Set document behavior if file validation fails" and select "Block files"

# Alternative: Configure via Registry for Visio 2016
reg add "HKCU\Software\Microsoft\Office\16.0\Visio\Security" /v "VBAWarnings" /t REG_DWORD /d 4 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Visio\Security\ProtectedView" /v "DisableInternetFilesInPV" /t REG_DWORD /d 0 /f