🔴 CVE-2022-30190 — Follina (MSDT RCE) Lab

Researcher: Abhimanyu Rawat Role: Technical Research & Cyber Security Operations Intern Date: May 8, 2026

📌 What is Follina?

CVE-2022-30190 (nicknamed "Follina") is a zero-day Remote Code Execution (RCE) vulnerability in Microsoft Windows that allows an attacker to execute arbitrary commands simply by having a victim open a Word document — no macros required.

It works by abusing the ms-msdt:// URI handler, a legitimate Windows diagnostic protocol, through Microsoft Office's external template feature.

🧪 Lab Environment

⚠️ Disclaimer: This lab was conducted in a fully isolated VMware environment for educational research purposes only. No real systems were targeted.

🔴 Attack Chain

Attacker (Kali)                          Victim (Windows 10)
      │                                         │
      │── python3 follina.py ──────────────────►│ clickme.docx served
      │                                         │
      │                                    Word opens doc
      │                                         │
      │◄── GET /exploit.html ───────────────────│ ms-msdt:// triggered
      │                                         │
      │── exploit.html sent ───────────────────►│
      │                                         │
      │                                   MSDT executes
      │                                   calc.exe  ✅

Stage 1: Payload generated with follina.py → clickme.docx + exploit.html Stage 2: Windows VM opened document in Word 2019 → clicked Enable Editing Stage 3: Word fetched exploit.html from Kali HTTP server via ms-msdt:// handler Stage 4: MSDT executed calc.exe — arbitrary code execution confirmed

🟢 Suricata IDS Detection

Custom Suricata rule SID:9000002 fired 8 times in fast.log:

05/08/2026-07:21:31 [**] [1:9000002:1] CVE-2022-30190 Follina exploit.html Fetch Detected [**]
[Classification: A Network Trojan was detected] [Priority: 1]
{TCP} 192.168.153.129:51278 -> 192.168.153.128:8000

Detection rule used:

alert http any any -> any any (msg:"CVE-2022-30190 Follina exploit.html Fetch Detected"; flow:established,to_server; content:"exploit.html"; http_uri; nocase; classtype:trojan-activity; sid:9000002; rev:1;)

📁 Files in This Repo

🛡️ Mitigation

Apply KB5014699 — Released June 14, 2022. Removes the ms-msdt:// URI handler from Windows entirely.

Verify patch is installed:

wmic qfe list | findstr "5014699"

🗺️ MITRE ATT&CK Mapping

🔗 References

• NVD — CVE-2022-30190
• Microsoft Security Advisory
• chvancooten/follina.py
• Suricata Documentation