It’s a zero day allowing code execution in Office products. Historically, when there’s easy ways to execute code directly from Office, people use it to do bad things. This breaks the boundary of having macros disabled. Vendor detection is poor. — DoublePulsar
Kevin Beaumont named it Follina after nao_sec spotted a Word document that fetches an HTML file through the remote template feature, which then hands PowerShell to msdt via the ms-msdt URI scheme, macros disabled or not. Protected View does kick in, but save the thing as RTF and the Explorer preview pane runs it without anyone opening the file.
More samples using the ms-msdt handler turned up within days. On May 29 Rich Warren shared VirusTotal alerts for an msdt PowerShell injection rule he had only been tracking since the day before, and on May 31 he posted six sample hashes. The same day Xavier Mertens reported the first exploitation of Follina seen in the wild on SANS ISC: his YARA rule on VirusTotal mostly caught proof-of-concept documents, plus one uploaded from Ireland with a different URL and payload.
In the meantime Microsoft issued mitigation recommendations for CVE-2022-30190: Disable the MSDT URL Protocol. Troubleshooters then no longer launch from links but stay available in the Get Help app. Deploying this mitigation would best be done via a GPO.
reg export HKEY_CLASSES_ROOT\ms-msdt follina.reg
reg delete HKEY_CLASSES_ROOT\ms-msdt /fThe same guidance says Protected View prevents the attack, which politely skips the RTF preview trick; the actual fix shipped with the Windows updates of June 14, 2022.