{"uuid": "08a62b29-fe77-4108-b13e-a06313fb77d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30190", "type": "seen", "source": "https://t.me/hacking_Attack/55850", "content": "Black Hat Ethical Hacking\nNew Windows Search zero-day added to Microsoft protocol nightmare\n\nNew Windows Search zero-day added to Microsoft protocol nightmarePost Views: 6 \nPremium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA new Windows Search zero-day vulnerability can be used to automatically open a search window containing remotely-hosted\u00a0malware executables simply by launching a Word document.\nThe security issue can be leveraged because Windows supports a URI protocol handler called \u2018search-ms\u2019 that allows applications and HTML links to launch customized searches on a device.\n\nWhile most Windows searches will look on the local device\u2019s index, it is also possible to force Windows Search to query file shares on remote hosts and use a custom title for the search window.\n\nFor example, the popular Sysinternals toolset allows you to remotely mount live.sysinternals.com\u00a0as a network share to launch their utilities. To search this remote share and list only files matching a particular name, you could use the following \u2018search-ms\u2019 URI: search-ms:query=proc&crumb=location:%5C%5Clive.sysinternals.com&displayname=Searching%20SysinternalsAs you can see from the command above, the search-ms \u2018crumb\u2019 variable specifies the location to search, and the \u2018displayname\u2019 variable specifies the search title.\n\nA customized search window will appear when this command is executed from a Run dialog or web browser address bar on Windows 7, Windows 10, and Windows 11, as shown below.\nhttps://www.bleepstatic.com/images/news/Microsoft/vulnerabilities/search-ms-protocol-handler/search-ms-sysinternals.jpg \nMicrosoft Office\u00a0takes it to the next levelThis week, researchers discovered\u00a0that threat actors were utilizing a new Windows zero-day vulnerability in Microsoft Windows Support Diagnostic Tool (MSDT). To exploit it, threat actors created malicious Word documents that launched the \u2018ms-msdt\u2019 URI protocol handler to execute PowerShell commands simply by opening the document.\n\nIdentified as CVE-2022-30190, the flaw makes it possible to modify Microsoft Office documents to bypass Protected View and launch URI protocol handlers without interaction by users, which will only lead to further abuse of protocol handlers.\n\nThis was seen yesterday when Hickey converted existing Microsoft Word MSDT exploits\u00a0to use the search-ms protocol handler we described earlier[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:37.542121Z"}