CVE-2022-44666
published 2022-12-13CVE-2022-44666: Windows Contacts Remote Code Execution Vulnerability
PriorityP355high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
40.44%
98.5th percentile
Windows Contacts Remote Code Execution Vulnerability
Affected
46 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.19624 | 10.0.10240.19624 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.5582 | 10.0.14393.5582 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.3770 | 10.0.17763.3770 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.3770 | 10.0.17763.3770 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.2364 | 10.0.19042.2364 |
| microsoft | windows_10_version_21h1 | >= 10.0.0 < 10.0.19043.2364 | 10.0.19043.2364 |
| microsoft | windows_10_version_21h2 | >= 10.0.19044.0 < 10.0.19044.2364 | 10.0.19044.2364 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.2364 | 10.0.19045.2364 |
| microsoft | windows_11 | — | — |
| microsoft | windows_11_version_21h2 | >= 10.0.22000.0 < 10.0.22000.1335 | 10.0.22000.1335 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.993 | 10.0.22621.993 |
| microsoft | windows_7 | >= 6.1.0 < 6.1.7601.26266 | 6.1.7601.26266 |
| microsoft | windows_7_service_pack_1 | >= 6.1.0 < 6.1.7601.26266 | 6.1.7601.26266 |
| microsoft | windows_8.1 | >= 6.3.0 < 6.3.9600.20721 | 6.3.9600.20721 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.26266 | 6.1.7601.26266 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.21815 | 6.0.6003.21815 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.24018 | 6.2.9200.24018 |
Detection & IOCsextracted from sources · hover to see the quote
urlgithub.com/j00sean/CVE-2022-44666
snort
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Microsoft Windows Contacts Syslink Control href Attribute Escape (CVE-2022-44666)"; flow:established,to_client; file.data; content:"BEGIN:VCARD"; fast_pattern; pcre:"/\x0a(?:EMAIL|URL)\x3b[^\x20\x0a]*?\x20href\x3d/"; reference:url,github.com/j00sean/CVE-2022-44666; reference:cve,2022-44666; classtype:social-engineering; sid:2058433; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2024_12_20, cve CVE_2022_44666, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Major, tag Phishing, tag Exploit, updated_at 2024_12_20, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing; target:dest_ip;)
- →Detect malicious VCARD files exploiting the Syslink Control href attribute escape: look for network traffic containing 'BEGIN:VCARD' where an EMAIL or URL field is followed by a space-separated 'href=' attribute, indicating an attempt to inject a malicious link via the Windows Contacts Syslink control.
- →The exploit is delivered via social engineering — an attacker convinces a victim to download and open a specially crafted file (VCARD/.contact), leading to local code execution. Monitor for user-initiated opening of .vcf or .contact files received from external sources. ↗
- →The Snort/Suricata rule (SID 2058433) is designed for perimeter deployment with TLS decryption (SSLDecrypt) enabled, meaning detection requires inspection of decrypted TLS traffic for the VCARD payload pattern.
- ·The Snort/Suricata rule requires TLS decryption to be active ('tls_state TLSDecrypt') at the perimeter sensor; without SSL inspection, the VCARD payload pattern will not be visible in encrypted traffic.
- ·Exploit status at time of advisory: not publicly disclosed and not exploited in the wild, but rated 'Exploitation More Likely' for older software releases — prioritize patching on legacy Windows versions. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_msrc7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Windows Contacts Remote Code Execution Vulnerability
vendor_msrc·2022-12-13·CVSS 7.8
CVE-2022-44666 [HIGH] Windows Contacts Remote Code Execution Vulnerability
Windows Contacts Remote Code Execution Vulnerability
FAQ: According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.
For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.
Windows Contacts: Windows Contacts
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Re
GHSA
GHSA-7g33-cr66-hx65: Windows Contacts Remote Code Execution Vulnerability
ghsa_unreviewed·2022-12-13
CVE-2022-44666 [HIGH] GHSA-7g33-cr66-hx65: Windows Contacts Remote Code Execution Vulnerability
Windows Contacts Remote Code Execution Vulnerability.
Suricata
ET PHISHING Microsoft Windows Contacts Syslink Control href Attribute Escape (CVE-2022-44666)
suricata·2024-12-20·CVSS 7.8
CVE-2022-44666 [HIGH] ET PHISHING Microsoft Windows Contacts Syslink Control href Attribute Escape (CVE-2022-44666)
ET PHISHING Microsoft Windows Contacts Syslink Control href Attribute Escape (CVE-2022-44666)
Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Microsoft Windows Contacts Syslink Control href Attribute Escape (CVE-2022-44666)"; flow:established,to_client; file.data; content:"BEGIN:VCARD"; fast_pattern; pcre:"/\x0a(?:EMAIL|URL)\x3b[^\x20\x0a]*?\x20href\x3d/"; reference:url,github.com/j00sean/CVE-2022-44666; reference:cve,2022-44666; classtype:social-engineering; sid:2058433; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2024_12_20, cve CVE_2022_44666, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Major, tag Phishing, tag Exploit, updated_at 2024
No public exploits indexed.
No writeups or analysis indexed.
2022-12-13
Published