Monday, June 16, 2025
HomeCVE/vulnerabilityPowerPoint file Equipped with CVE-2017-0199 could Compromise Your System

PowerPoint file Equipped with CVE-2017-0199 could Compromise Your System

Published on

SIEM as a Service

Follow Us on Google News

Security experts from FortiGuard Labs discovered a malicious Powerpoint file in name ADVANCED DIPLOMATIC PROTOCOL AND ETIQUETTE SUMMIT.ppsx using the CVE-2017-0199 Vulnerability.By opening, this malicious PDF file may compromise your system.

CVE-2017-0199 was originally a zero-day remote code execution vulnerability that allowed attackers to use a flaw that exists within the Windows Object Linking and Embedding (OLE) interface of Microsoft workplace to deliver malware.

This vulnerability has been disclosed and patched in last April 2017. This vulnerability triggers an RCE with Microsoft Office or Word with specially crafted files.

- Advertisement - Google News

Fortigate identified that the flaw is used by attackers in Windows Object Linking and Embedding (OLE) interface of Microsoft Office and gain control over the system.

Powerpoint Malware
Source : Fortinet

When the malicious file opened by the user it triggers ppt/slides/_rels/slide1.xml.rels and then it use to download remote code from hxxp://www[.]narrowbabwe[.]net:3345/exp[.]doc.The remote code developers include blank spaces to evade malware detection.

Also Read Exploit Windows Remote PC with EternalBlue & DoublePulsar Exploit through Metasploit

They observed that exploit to use to download the doc file and it consist of XMLand JavaScripts.The Java Script used to escalate Privilege and bypass UAC.The UAC bypass method involves hijacking the registry in HKCU\software\classes\mscfile\shell\open\command and then executing eventvwr.exe.

After decoding all the scripts it will read the following registry if it dosesn’t exists it will create them.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Seed0
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Feed0

Then it looks for the network adapter configured to connect with C&C server HTTP POST to hxxp://www[.]narrowbabwe[.]net/comsary/index[.]php to connect and download the malicious payload to establish control over the machine.

Also Read Exploitation Framework for Embedded devices – RouterSploit

Solution From Fortinet

  • Apply the patches released by Microsoft in April that covers the CVE-2017-0199 vulnerability.
  • FortiGuard Antivirus service detects this threat as
  • MSOffice/Downloader!exploit.CVE20170199
  • FortiGuard Web Filtering service blocks all C&C and related URLs.
  • FortiSandbox rates the PPSX file as High Risk.

https://www.youtube.com/watch?v=zpfNf8JTSQM

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Kali Linux 2025.2 Released: New Tools, Smartwatch and Car Hacking Added

Kali Linux, the preferred distribution for security professionals, has launched its second major release...

Arsen Launches AI-Powered Vishing Simulation to Help Organizations Combat Voice Phishing at Scale

Arsen, the cybersecurity startup known for defending organizations against social engineering threats, has announced...

NIST Releases New Guide – 19 Strategies for Building Zero Trust Architectures

The National Institute of Standards and Technology (NIST) has released groundbreaking guidance to help...

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...

Credential Abuse: 15-Min Attack Simulation

Credential Abuse Unmasked

Credential abuse is #1 attack vector in web and API breaches today (Verizon DBIR 2025). Join our live, 15-min attack simulation with Karthik Krishnamoorthy (CTO - Indusface) and Phani Deepak Akella (VP of Marketing - Indusface) to see hackers move from first probe to full account takeover.

Discussion points


Username & email enumeration – how a stray status-code reveals valid accounts.
Password spraying – low-and-slow guesses that evade basic lockouts.
Credential stuffing – lightning-fast reuse of breach combos at scale.
MFA / session-token bypass – sliding past second factors with stolen cookies.

More like this

Severe WSO2 SOAP Flaw Allows Unauthorized Password Resets for Any Use

A newly disclosed vulnerability, CVE-2024-6914, has shocked the enterprise software community, affecting a wide...

CISA Alerts on Threat Actors Targeting Commvault Azure App to Steal Secrets

On May 22, 2025, Commvault, a leading enterprise data backup provider, issued an urgent...

PoC Code Published for Linux nftables Security Vulnerability

Security researchers have published proof-of-concept (PoC) exploit code for CVE-2024-26809, a high-severity double-free vulnerability in...