CVE-2022-30190 PoC — Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Title:Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability (CVE-2022-30190)
Description:A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.

Mitigation for CVE-2022-30190

# CVE-2022-30190
Mitigation for CVE-2022-30190

Script requires to be run as Adminstrator. This script has been tested with Connectwise Automate RMM tool for deployment.

I found this solution cleaner than backup up and deleting anything from the registry, as this can simply update the DWORD key value to "1" to return functionality.

Alternatively the script can be modified to find and remove the added registry key.

 [4.0K]  /data/pocs/80c40fef3ddc54c59d7d36f7aa2a9f2d9db06552
├── [ 456]  cve-2022-30190.ps1
└── [ 420]  README.md

0 directories, 2 files