Microsoft Office365 Integrity Validation / Remote Code Execution

`# Exploit Title: Microsoft Office365 Remote Code Execution Vulnerability  
# Date: 2/11/19  
# Exploit Author: Social Engineering Neo - @EngineeringNeo  
# Vendor Homepage: https://microsoft.com  
# Software Link: https://office.com  
# Version: Office365/ProPlus (build 16.0.11727.20222, 16.0.11901.20170, 16.0.11901.20204 & 16.0.11929.202.88)  
# Tested on: Windows 10 (build 17763.253, 18362.295 & 18362.356)  
  
  
Affected Platforms: -  
Microsoft Windows ≤10  
Office365 & ProPlus Products ≤2019  
  
  
Tested On: -  
Windows 10 (build 17763.253, 18362.295 & 18362.356)  
Office365/ProPlus (build 16.0.11727.20222, 16.0.11901.20170, 16.0.11901.20204 & 16.0.11929.202.88)  
Most up to-date version of Microsoft Windows & Office365/ProPlus Products are affected.  
  
  
Base: -  
CWE-325 - Missing Required Cryptographic Step.  
The software does not implement a required step in a cryptographic algorithm used to validate the original integrity of documents.  
  
  
Summary: -  
Improper Integrity Validation of Office Documents Resulting in Multiple Microsoft Office Products Suffering from a Protection Bypass Vulnerability. Allowing Auto-Execution of Macro Code Inside Macro-Enabled Office Documents.  
  
  
Short Description: -  
Overwriting an original macro-enabled document with a malicious document will bypass the built-in protections.  
  
  
Long Description: -  
A user creates a macro-enabled MS Word document and saves the document with text/data inside.  
If the user deletes the document and downloads a completely different document with the same name, this can allow remote code execution.  
When a document is opened/edited, Office apps keep a record of the name and permissions associated with the specific document.  
This can be abused when downloading a malicious document to run code remotely on the machine.  
  
  
Proof of Concept: -  
=====  
Tested on Latest Versions of Access, Excel, InfoPath, OneNote, Outlook, PowerPoint, Project, Publisher, Visio, Word.  
  
Affects Access, Excel, InfoPath, PowerPoint, Visio, Word.  
Does not affect OneNote, Outlook, Project, Publisher.  
  
ATTACKER: -  
Step 0.) - Knowledge of Office document names on VICTIM device.  
Step 1.) - Inject malicious VBA macro code & payload into Office document. *preferably AV evasive*  
Step 2.) - Send malicious macro-enabled document to VICTIM through internet.  
Step 3.) - Setup bind/reverse connection.  
  
VICTIM: -  
Step 1.) - Download document sent by ATTACKER.  
Step 2.) - Open Document in same location as previous document.  
  
[CODE EXECUTION SUCCESSFUL]  
  
VIDEO: - https://youtu.be/YVF7gqWZSGE  
=====  
  
  
Expected Result: -  
It shouldn't be possible to automatically execute macro code on the host machine without user consent or additional configuration.  
(Clean Install)  
  
  
Observed Result: -  
Office document auto-executes macro code upon loading document without any user consent, in our case leading to remote code execution.  
(User Level Access)  
`