FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY[html]
FireEye recently detected a malicious Microsoft Office RTF document
that leveraged href="https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8759">CVE-2017-8759,
a SOAP href="https://msdn.microsoft.com/en-us/library/ms996486.aspx">WSDL
parser code injection vulnerability. This vulnerability allows a
malicious actor to inject arbitrary code during the parsing of SOAP
WSDL definition contents. FireEye analyzed a Microsoft Word document
where attackers used the arbitrary code injection to download and
execute a Visual Basic script that contained PowerShell commands.
FireEye shared the details of the vulnerability with Microsoft and
has been coordinating public disclosure timed with the release of a
patch to address the vulnerability and security guidance, which can be
found here.
FireEye email, endpoint and network products detected the malicious documents.
Vulnerability Used to Target Russian Speakers
The malicious document, “Проект.doc” (MD5:
fe5c4d6bb78e170abf5cf3741868ea4c), might have been used to target a
Russian speaker. Upon successful exploitation of CVE-2017-8759, the
document downloads multiple components (details follow), and
eventually launches a FINSPY payload (MD5: a7b990d5f57b244dd17e9a937a41e7f5).
FINSPY malware, also reported as FinFisher or href="http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf">WingBird,
is available for purchase as part of a “lawful intercept” capability.
Based on this and previous use of href="https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html">FINSPY,
we assess with moderate confidence that this malicious document was
used by a nation-state to target a Russian-speaking entity for cyber
espionage purposes. Additional detections by FireEye’s Dynamic Threat
Intelligence system indicates that related activity, though
potentially for a different client, might have occurred as early as
July 2017.
CVE-2017-8759 WSDL Parser Code Injection
A code injection vulnerability exists in the WSDL parser module
within the PrintClientProxy method ( href="http://referencesource.microsoft.com/#System.Runtime.Remoting/metadata/wsdlparser.cs,6111">http://referencesource.microsoft.com/
- System.Runtime.Remoting/metadata/wsdlparser.cs,6111). The
IsValidUrl does not perform correct validation if provided data that
contains a CRLF sequence. This allows an attacker to inject and
execute arbitrary code. A portion of the vulnerable code is shown in
Figure 1.
Figure 1: Vulnerable WSDL Parser
When multiple address definitions are provided in a SOAP
response, the code inserts the “//base.ConfigureProxy(this.GetType(),”
string after the first address, commenting out the remaining
addresses. However, if a CRLF sequence is in the additional addresses,
the code following the CRLF will not be commented out. Figure 2 shows
that due to lack validation of CRLF, a
System.Diagnostics.Process.Start method call is injected. The
generated code will be compiled by csc.exe of .NET framework, and
loaded by the Office executables as a DLL.
Figure 2: SOAP definition VS Generated code
The In-the-Wild Attacks
The attacks that FireEye observed in the wild leveraged a Rich Text
Format (RTF) document, similar to the href="https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html">CVE-2017-0199
documents we previously reported on. The malicious sampled contained
an embedded SOAP monikers to facilitate exploitation (Figure 3).
Figure 3: SOAP Moniker
The payload retrieves the malicious SOAP WSDL definition from an
attacker-controlled server. The WSDL parser, implemented in
System.Runtime.Remoting.ni.dll of .NET framework, parses the content
and generates a .cs source code at the working directory. The csc.exe
of .NET framework then compiles the generated source code into a
library, namely http[url path].dll. Microsoft Office then loads the
library, completing the exploitation stage.
