CVE-2022-30190: Microsoft Windows 10 1507 RCE Vulnerability

CVE-2022-30190 Overview

CVE-2022-30190, widely known as Follina, is a remote code execution vulnerability in the Microsoft Support Diagnostic Tool (MSDT). Attackers exploit the flaw by abusing the ms-msdt: URL protocol handler from calling applications such as Microsoft Word. A successful attacker runs arbitrary code with the privileges of the calling application and can install programs, view or modify data, and create new accounts. The vulnerability affects nearly all supported Windows desktop and server editions. CISA added CVE-2022-30190 to its Known Exploited Vulnerabilities catalog, and public proof-of-concept exploits are available.

Critical Impact
Attackers can execute arbitrary code by tricking users into opening a malicious Office document or RTF file, requiring no macros and bypassing Protected View in some scenarios.

Affected Products

Microsoft Windows 10 (versions 1507 through 21H2) and Windows 11 21H2
Microsoft Windows 7 SP1, Windows 8.1, and Windows RT 8.1
Microsoft Windows Server 2008 R2, 2012, 2012 R2, 2016, 2019, 2022, and 20H2

Discovery Timeline

2022-06-01 - CVE-2022-30190 published to NVD
2025-10-30 - Last updated in NVD database

Technical Details for CVE-2022-30190

Vulnerability Analysis

The vulnerability resides in how the Microsoft Support Diagnostic Tool handles URI invocations through the ms-msdt: protocol handler. A weaponized Office document references a remote HTML payload through its template relationship file. When the document opens, Word fetches the remote HTML, which contains a ms-msdt: URI with an embedded PowerShell payload encoded in the IT_BrowseForFile parameter. Windows resolves the protocol handler and launches msdt.exe, which parses the URI and executes the attacker-supplied command. Execution occurs under the user context of the calling application, and the technique works without macros being enabled.

Root Cause

The root cause is improper validation of input passed to MSDT through the URL protocol. MSDT expands the IT_BrowseForFile parameter as a command-line argument without sanitizing PowerShell syntax embedded in the value. The diagnostic troubleshooter pack accepts and executes script content supplied through a user-controlled URI.

Attack Vector

The attack vector is local with user interaction. An attacker delivers a malicious .docx, .rtf, or .doc file via phishing, web download, or removable media. Opening the document (or in some cases, merely previewing it in Explorer for RTF) triggers retrieval of the remote HTML and invocation of msdt.exe. The payload typically launches PowerShell to download and execute follow-on tooling such as Cobalt Strike beacons or info-stealers.

A verified proof-of-concept is published at Follina-Vulnerability-CVE-2022-30190-Exploit-Analysis, and a public exploit is available via Packet Storm. Refer to these sources for technical exploitation details.

Detection Methods for CVE-2022-30190

Indicators of Compromise

msdt.exe spawned as a child process of Microsoft Office applications such as winword.exe, excel.exe, or outlook.exe
Process command lines for msdt.exe containing IT_BrowseForFile, IT_RebrowseForFile, or PCWDiagnostic
sdiagnhost.exe launching powershell.exe, cmd.exe, or other LOLBins
Office applications making outbound HTTP requests to retrieve remote .html template targets

Detection Strategies

Hunt for parent-child process relationships where Office binaries spawn msdt.exe or sdiagnhost.exe
Inspect command-line arguments to msdt.exe for embedded PowerShell, base64-encoded payloads, or suspicious $() syntax
Monitor for Word documents containing external OLE template references to remote HTML files via inspection of word/_rels/document.xml.rels

Monitoring Recommendations

Enable PowerShell Script Block Logging (Event ID 4104) and Module Logging to capture decoded payloads launched through MSDT
Forward Sysmon Event ID 1 (Process Creation) and Event ID 3 (Network Connection) for Office and diagnostic binaries to a central SIEM
Alert on creation of files in %TEMP% or %LOCALAPPDATA% immediately following msdt.exe execution

How to Mitigate CVE-2022-30190

Immediate Actions Required

Apply the June 2022 cumulative Windows security updates from the Microsoft Security Response Center advisory to all affected systems
Prioritize patching of internet-facing workstations, email gateways, and any host running Microsoft Office
Review endpoint telemetry retroactively for the IOCs listed above, given the vulnerability's presence on the CISA Known Exploited Vulnerabilities catalog

Patch Information

Microsoft released fixes in the June 2022 Patch Tuesday cumulative updates covering all supported Windows desktop and server editions. Patch details and KB article references are available at the Microsoft CVE-2022-30190 update guide.

Workarounds

Disable the MSDT URL protocol by deleting the HKEY_CLASSES_ROOT\ms-msdt registry key after exporting a backup with reg export HKEY_CLASSES_ROOT\ms-msdt msdt.reg
Enable Attack Surface Reduction (ASR) rules in Microsoft Defender, specifically Block all Office applications from creating child processes
Enforce Protected View and Office Application Guard, and block outbound network connections from Office binaries via host firewall policy

bash

# Configuration example: disable the ms-msdt URL protocol handler
reg export HKEY_CLASSES_ROOT\ms-msdt msdt-backup.reg
reg delete HKEY_CLASSES_ROOT\ms-msdt /f