Stefan Mileschin

Pass the SOAP

FireEye found a malicious Microsoft Office RTF document which has all the hallmarks of being made by the CIA to hack Microsoft Office docs.

The hack used CVE-2017-8759, a SOAP WSDL parser code injection vulnerability. This vulnerability allows a malicious actor to inject arbitrary code during the parsing of SOAP WSDL definition contents. FireEye analyzed a Microsoft Word document where attackers used the arbitrary code injection to download and execute a Visual Basic script that contained PowerShell commands.

http://fudzilla.com/news/44498-firee...ft-office-hack