KB5005563: Windows Server Security Update (September 2021)
Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution.
A remote attacker, without authentication, can achieve partial data exposure, arbitrary modification of data, partial service disruption. CISA has confirmed use of this vulnerability in known ransomware campaigns — treat as high priority for remediation. Federal agencies are required to remediate by 2021-11-17 under CISA BOD 22-01.
This is a Path Traversal (CWE-22) vulnerability in Microsoft MSHTML. <p>Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents.</p> <p>An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p> <p>Microsoft Defender Antivirus and Microsoft Defender for Endpoint both provide detection and protections for the known vulnerability. Customers should keep antimalware products up to date. Customers who utilize automatic updates do not need to take additional action. Enterprise customers who manage updates should select the detection build 1.349.22.0 or newer and deploy it across their environments. Microsoft Defender for Endpoint alerts will be displayed as: “Suspicious Cpl File Execution”.</p> <p>Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.</p> <p>Please see the <strong>Mitigations</strong> and <strong>Workaround</strong> sections for important information about steps you can take to protect your system from this vulnerability.</p> <p><strong>UPDATE</strong> September 14, 2021: Microsoft has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. Please see the FAQ for important information about which updates are applicable to your system.</p> Exploitation requires remote network access, low attack complexity, no authentication required, and user interaction required.
📧
Phishing link
🖼
Malicious file
🔓
Server compromised
Probably yes if any of these apply:
Used in known ransomware campaigns. Threat-research write-up: http://packetstormsecurity.com/files/165214/Microsoft-Office-Word-MSHTML-Remote-Code-Execution.html
Manual download
For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.
↗ Microsoft Update CatalogKB5005563Manual remediation steps
Apply the Microsoft Security Update
Microsoft has released an official security update that fixes this vulnerability.
Required KB Updates
Supersedes: KB5005030, KB5005031, KB5005033, KB5005036, KB5005040, KB5005043, KB5005076, KB5005088, KB5005090, KB5005094
Affected Products
Fixed Build Numbers
Installation Methods
Windows Update (recommended)
Microsoft Update Catalog (manual download)
.msu installer with administrator privilegesWSUS / SCCM / Intune
Approve KB5005563 for the affected products in your update management console.
Microsoft Download Center Links
Verification
Confirm the update is installed:
Get-HotFix | Where-Object { $_.HotFixID -in @('KB5005563','KB5005565','KB5005566','KB5005568','KB5005569','KB5005573','KB5005575','KB5005606','KB5005613','KB5005623','KB5005627','KB5005633','KB5019958') }
References
Discovery Credit
Bryce Abdo of Mandiant, Haifei Li of EXPMON, Genwei Jiang of Mandiant, Rick Cole (MSTIC), Dhanesh Kizhakkinan of Mandiant
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.