CVE-2022-21842: Microsoft SharePoint Server RCE Vulnerability

CVE-2022-21842 Overview

CVE-2022-21842 is a remote code execution vulnerability affecting Microsoft Word and SharePoint Enterprise Server. This vulnerability allows an attacker to execute arbitrary code in the context of the current user when a specially crafted document is opened. The attack requires user interaction, as the victim must open a malicious Word document for the exploit to succeed.

Critical Impact

Successful exploitation allows attackers to execute arbitrary code with the privileges of the current user, potentially leading to complete system compromise, data theft, or lateral movement within an organization's network.

Affected Products

• Microsoft Word 2016 (x64)
• Microsoft Word 2016 (x86)
• Microsoft SharePoint Enterprise Server 2016

Discovery Timeline

• 2022-01-11 - CVE-2022-21842 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-21842

Vulnerability Analysis

This remote code execution vulnerability exists in Microsoft Word's document processing functionality. The vulnerability is triggered when Word parses a maliciously crafted document file. Due to improper handling of certain document elements, an attacker can craft a document that, when opened, causes Word to execute arbitrary code.

The attack requires local access to deliver the malicious document and user interaction to open it. However, delivery mechanisms can include email attachments, shared network drives, or web downloads. Once the victim opens the document, the attacker gains code execution with the same privileges as the user running Microsoft Word.

For SharePoint Enterprise Server deployments, this vulnerability could potentially be exploited when the server processes uploaded documents, though the primary attack vector remains client-side via Microsoft Word.

Root Cause

Microsoft has not disclosed the specific technical root cause of this vulnerability. The CWE classification (NVD-CWE-noinfo) indicates that detailed vulnerability categorization information was not provided by the vendor. Based on the nature of the vulnerability—remote code execution through document parsing—it likely involves memory corruption or improper input validation in Word's document handling code.

Attack Vector

The attack vector requires local file access, meaning an attacker must deliver a malicious document to the victim's system. Common delivery methods include:

• Phishing emails with malicious Word document attachments
• Hosting malicious documents on compromised or attacker-controlled websites
• Placing documents on shared network drives accessible to targets
• Social engineering techniques to convince users to open documents

The attack requires no special privileges from the attacker, but does require user interaction—specifically, the victim must open the malicious document. Upon opening the document, the exploit executes with the permissions of the current user, which could include administrative privileges if the user has elevated access.

Detection Methods for CVE-2022-21842

Indicators of Compromise

• Unexpected Microsoft Word processes spawning child processes such as cmd.exe, powershell.exe, or other suspicious executables
• Word documents with unusual file structures or embedded objects received from external or untrusted sources
• Abnormal network connections initiated by WINWORD.EXE following document opening
• Crash dumps or Windows Error Reporting events related to Microsoft Word

Detection Strategies

• Monitor for suspicious process creation chains originating from WINWORD.EXE
• Implement email gateway scanning for malicious document attachments
• Deploy endpoint detection rules to identify Word documents attempting to execute code or spawn processes
• Enable Microsoft Defender Attack Surface Reduction rules to block Office applications from creating child processes

Monitoring Recommendations

• Enable Windows event logging for process creation (Event ID 4688) with command line auditing
• Monitor for Office applications making unexpected network connections
• Configure SIEM alerts for suspicious parent-child process relationships involving Office applications
• Review SharePoint server logs for anomalous document processing activity

How to Mitigate CVE-2022-21842

Immediate Actions Required

• Apply the latest Microsoft security updates for affected products immediately
• Ensure Microsoft Word 2016 and SharePoint Enterprise Server 2016 are updated with January 2022 patches
• Warn users about the risks of opening untrusted Word documents
• Review and restrict document handling permissions where possible

Patch Information

Microsoft has released security updates to address this vulnerability as part of their January 2022 Patch Tuesday release. Administrators should download and apply the appropriate patches from the Microsoft Security Update Guide. The full security advisory is available at the Microsoft Security Response Center.

For enterprise environments, use Windows Server Update Services (WSUS), Microsoft Endpoint Configuration Manager, or other patch management solutions to deploy updates across the organization.

Workarounds

• Enable Protected View in Microsoft Word to open documents from the internet in a restricted sandbox
• Configure Microsoft Office to block macros and active content from untrusted sources
• Use Microsoft Defender Application Guard for Office to isolate potentially malicious documents
• Implement email filtering to quarantine Word documents from external senders for manual review