CVE-2017-0199

🗓️ 12 Apr 2017 14:00:00Reported by microsoftType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 3947 Views🌐 WEB

Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows AP

Reporter	Title	Published	Views	Family All 232
GithubExploit	Exploit for CVE-2017-0199	24 Apr 201723:44	–	githubexploit
GithubExploit	Exploit for CVE-2017-0199	15 Aug 202207:15	–	githubexploit
GithubExploit	Exploit for CVE-2017-0199	18 Apr 201706:33	–	githubexploit
GithubExploit	Exploit for CVE-2017-8570	8 Apr 201810:07	–	githubexploit
GithubExploit	Exploit for CVE-2017-0199	23 Apr 201713:58	–	githubexploit
GithubExploit	Exploit for Code Injection in Microsoft	13 Sep 201715:24	–	githubexploit
GithubExploit	Exploit for CVE-2022-30190	21 Jan 202611:02	–	githubexploit
GithubExploit	Exploit for CVE-2017-0199	17 Apr 201708:10	–	githubexploit
GithubExploit	Exploit for CVE-2017-0199	22 Apr 201704:01	–	githubexploit
zdt	Microsoft Office / WordPad Remote Code Execution Vulnerability	16 Apr 201700:00	–	zdt

NVD

Node

microsoft officeMatch2007sp3

microsoft officeMatch2010sp2

microsoft officeMatch2013sp1

microsoft officeMatch2016-

microsoft windows_7Match-sp1

microsoft windows_server_2008Match-sp2

microsoft windows_server_2008Matchr2sp1

microsoft windows_server_2012Match-

microsoft windows_vistaMatch-sp2

Node

philips intellispace_portalMatch7.0

philips intellispace_portalMatch8.0

[
  {
    "product": "Office/WordPad",
    "vendor": "Microsoft Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8.1"
      }
    ]
  }
]

Source	Link
rewtin	www.rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html
blog	www.blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/
securitytracker	www.securitytracker.com/id/1038224
ics-cert	www.ics-cert.us-cert.gov/advisories/ICSMA-18-058-02
exploit-db	www.exploit-db.com/exploits/41934/
fireeye	www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html
exploit-db	www.exploit-db.com/exploits/42995/
securityfocus	www.securityfocus.com/bid/97498
exploit-db	www.exploit-db.com/exploits/41894/
mdsec	www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/

Parameter	Position	Path	Description	CWE
HTA URL in OLE2Link	path	/logo.doc	RTF/OLE2Link remote code execution via external HTA payload referenced as a URL in the document (CVE-2017-0199).	CWE-94
OLE2Link object	path	/logo.doc	RTF/OLE2Link remote code execution via external HTA payload referenced as a URL in the document (CVE-2017-0199).	CWE-94
HTA payload URL	path	/test.hta	HTA-based execution trigger used in CVE-2017-0199 PoCs (Word/RTF HTA handler).	CWE-94
payload URL	path	/shell.exe	Payload downloaded and executed via HTA/Word OLE2Link chain (CVE-2017-0199).	CWE-94
HTA/Meterpreter payload	path	/shell.exe	Payload downloaded and executed via HTA/Word OLE2Link chain (CVE-2017-0199).	CWE-94
SOAP moniker WSDL URL	path	/evil.whatever	SOAP moniker-based WSDL injection used to trigger remoting code execution (CVE-2017-8759).	CWE-94
HTA file path	path	/w00t.hta	HTA delivery/execution component referenced in CVE-2017-8759 PPSX-based exploitation flow.	CWE-94
Resource loaded in PPSX/OOXML exploits	path	/logo.png	Image/resource fetched during OOXML moniker-based exploitation chains (CVE-2017-8759).	CWE-94
HTA URL	path	/default.hta	Default HTA URL used in the Word HTA execution PoC flow (CVE-2017-0199).	CWE-94
SCT file path	path	/calc.sct	SCT payload used in Composite/Script Moniker exploit flows (CVE-2017-8759).	CWE-94

17 Jun 2026 00:57Current

8.4High risk

Vulners AI Score8.4

CVSS 3.17.8

CVSS 29.3

EPSS0.99497

SSVC

In Wild