Microsoft Word (2016) Deceptive File Reference ZDI-CAN-7949

[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WORD-DECEPTIVE-FILE-REFERENCE.txt
[+] ISR: ApparitionSec
[+] Zero Day Initiative Program

[Vendor]
www.microsoft.com

[Product]
Microsoft Word 2016

[Vulnerability Type]
Deceptive File Reference

[References]
ZDI-CAN-7949

[Security Issue]
When a MS Word ".docx" File contains a hyperlink to another file, it will run the first file it finds in that directory with a
valid
extension. But will present to the end user an extension-less file in
its Security warning dialog box without showing the extension type.
If
another "empty" file of the same name as the target executable exists
but has no file extension. Because the extension is supressed it
makes the file seem harmless and the file can be masked to appear as just a folder etc.

This
can potentially trick user into running unexpected code, but will only
work when you have an additional file of same name with
NO extension on it.

[Exploit/POC]
1) Create a directory "PoC"

2) Create a folder in PoC directory named "Downloads Folder"

3) Create a .BAT file named "Downloads Folder.bat"

in the .BAT create some command like "start calc.exe"

4) Create an empty file named "Downloads Folder" with no file extension

5) Create the Word ".docx" file with a hyperlink pointing to "PoC/Downloads Folder/Downloads Folder"

Upon opening the link Word will give user an vague dialog box about asking if they want to open
the file. However, the prompt shows an apparent folder structure and no file extension .exe, .com etc
are visible or displayed to the end user.

Click the link to open what looks to be a folder then BOOM! the .BAT file runs instead.

Of course any exeuctable will do .EXE etc.

[Network Access]
Local

[Severity]
High

[POC Video URL]
https://www.youtube.com/watch?v=irxkV_qGG9Y

[Disclosure Timeline]
Notification: Trend Micro Zero Day Initiative Program : 2019-01-25

Case officially contracted to ZDI : 2019-02-06

Vendor Disclosure : 2019-02-15
submitted to the vendor as ZDI-CAN-7949.

ZDI Response : "We have synced with the vendor and they have resolved that this case
does not meet the bar for security servicing. Therefore we will proceed to close it on our end."

2019-06-14 : Public Disclosure

[+] Disclaimer
The
information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.
Permission
is hereby granted for the redistribution of this advisory, provided that
it is not altered except by reformatting it, and
that due credit is
given. Permission is explicitly given for insertion in vulnerability
databases and similar, provided that due credit
is given to the
author. The author is not responsible for any misuse of the information
contained herein and accepts no responsibility
for any damage caused
by the use or misuse of this information. The author prohibits any
malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx