Microsoft Windows 支持诊断工具 (MSDT) 远程代码执行漏洞（CVE-2022-30190）

2022-06-02

一、概要

近日，华为云关注到业界有安全研究人员披露漏洞代号为“Follina”，利用Windows 支持诊断工具 (MSDT)实现远程代码执行的技术细节。微软也已发布安全公告，根据微软官方描述，从 Word 等调用应用程序使用 URL 协议调用 MSDT 时存在远程执行代码漏洞（CVE-2022-30190），成功利用此漏洞的攻击者可以使用调用应用程序的权限运行任意代码。目前EXP/POC已公开，已出现在野利用，风险较高。

华为云提醒用户尽快安排自检并做好安全加固。

参考链接：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190

https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/

二、漏洞级别

漏洞级别：【严重】

（说明：漏洞级别共四级：一般、重要、严重、紧急）

三、影响范围

影响版本：

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows RT 8.1

Windows 8.1 for x64-based systems

Windows 8.1 for 32-bit systems

Windows 7 for x64-based Systems Service Pack 1

Windows 7 for 32-bit Systems Service Pack 1

Windows Server 2016  (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64-based Systems

Windows 10 Version 1607 for 32-bit Systems

Windows 10 for x64-based Systems

Windows 10 for 32-bit Systems

Windows 10 Version 21H2 for x64-based Systems

Windows 10 Version 21H2 for ARM64-based Systems

Windows 10 Version 21H2 for 32-bit Systems

Windows 11 for ARM64-based Systems

Windows 11 for x64-based Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64-based Systems

Windows 10 Version 20H2 for 32-bit Systems

Windows 10 Version 20H2 for x64-based Systems

Windows Server 2022 Azure Edition Core Hotpatch

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows 10 Version 21H1 for 32-bit Systems

Windows 10 Version 21H1 for ARM64-based Systems

Windows 10 Version 21H1 for x64-based Systems

Windows Server 2019  (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64-based Systems

Windows 10 Version 1809 for x64-based Systems

Windows 10 Version 1809 for 32-bit Systems

安全版本：暂无

五、安全建议

截止到目前微软官方还未发布安全补丁，请受影响用户关注微软官方发布补丁进展，及时升级修复。

缓解措施：

1、警惕点击来源不明的邮件附件文档；

2、禁用 MSDT URL 协议：参考官方提供的缓解措施，禁用 MSDT URL 协议或通过 Microsoft Defender 检测和保护系统进行临时缓解，详情请查看：guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability

注：修复漏洞前请将资料备份，并进行充分测试。