Windows 10: CVE-2022-30190 workaround for Windows 7

The guidance for CVE-2022-30190 mentions deleting the MSDT URL Protocol as a workaround for this vulnerability. https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/However, the FAQ says "The registry key mentioned in the workaround section will not exist in earlier supported versions of Windows, so the workaround is not required."Does this mean there is no workaround for Windows 7 and the only solution is to install the July 2022 security update?

:)

 

[NEW UNPATCHED EXPLOIT] How to be safe from the CVE-2022-30190 exploit (workaround / temporary fix until it is patched) (Windows 7+)

So, there has been a new exploit called CVE-2022-30190 (MSDT exploit) that's been going on for about 7 weeks (not 100% accurate) and I kinda wanted to make a little post about the official temporary workaround (Microsoft Security Response Center article here). Also yes, it should work for Windows® 7+.

What the exploit does (not in detail because I'm not qualified for it nor ThioJoe):

(Source: https://www.youtube.com/c/ThioJoe)

So the exploit uses MSDT (Microsoft Diagnostics Troobleshooting Wizard, which is a tool for sending some PC info to get easier help from the Microsoft Phone Support) to run Powershell / Command Prompt / Batch code from Shortcuts and Microsoft Word® files.

The Workaround removes the ability to search for "ms-msdt://" in any browser to open the app (this is how it runs the app to do the exploit)

Workaround / Temporary Fix:

(Source: Microsoft Security Response Center)

1. Run Command Prompt as Administrator.
   
2. To back up the registry key, execute the command “reg export HKEY_CLASSES_ROOT\ms-msdt filename.reg“
   
3. Execute the command “reg delete HKEY_CLASSES_ROOT\ms-msdt /f”.
   

How to undo the workaround (when it is patched)

1. Run Command Prompt as Administrator.
   
2. To restore the registry key, execute the command “reg import filename.reg”
   

(filename is the location of the file, I personally recommend to just put it in the C:\ drive e.g. "C:\Before CVE-2022-30190 was patched.reg")

Thanks for reading, and stay safe!

* Moved from Virus & Malware

 

CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability

Hi Brain

please simplify your response , do you mean if the folder ms-msdt is not in the registry , the server is not vulnarable to CVE-2022-30190

 

Undo Workaround After Follina Patch

See this post:

'Yes if you want to use that feature':

-

Microsoft schließt Follina-Schwachstelle (CVE-2022-30190) in Windows mit Juni 2022-Updates

German:

Microsoft schließt Follina-Schwachstelle (CVE-2022-30190) in Windows mit Juni 2022-Updates

English:

Microsoft patches Follina vulnerability (CVE-2022-30190) in Windows with June 2022 updates | Born's Tech and Windows World