CVE-2022-34713
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
Description
CVE-2022-34713 is a remote code execution vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT) that can be triggered when MSDT is called using the URL protocol from a calling application. Also known as "DogWalk," this vulnerability allows an attacker to execute arbitrary code on a target system by convincing a user to open a specially crafted file. CISA has added CVE-2022-34713 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 4.5% (89th percentile), this vulnerability shows elevated exploitation probability and represents a significant risk for Windows environments.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19387 |
| microsoft | windows 10 1607 | < 10.0.14393.5291 |
| microsoft | windows 10 1809 | < 10.0.17763.3287 |
| microsoft | windows 10 20h2 | < 10.0.19042.1889 |
| microsoft | windows 10 21h1 | < 10.0.19043.1889 |
| microsoft | windows 10 21h2 | < 10.0.19044.1889 |
| microsoft | windows 11 21h2 | < 10.0.22000.856 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.5291 |
| microsoft | windows server 2019 | < 10.0.17763.3287 |
| microsoft | windows server 2022 | < 10.0.20348.887 |
| microsoft | windows server 20h2 | < 10.0.19042.1889 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34713(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-34713(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CVE-2022-34713 involves improper input validation in Microsoft Windows MSDT when processing URL protocol calls. The diagnostic tool fails to properly validate input received through its URL protocol handler, allowing an attacker to craft malicious payloads that, when processed by MSDT, result in arbitrary code execution on the target system.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2022-34713 poses a significant threat to Windows environments because it can be exploited through common attack vectors such as malicious email attachments or crafted documents. The vulnerability requires user interaction — a victim must open a specially crafted file — but the social engineering required is minimal, as the malicious payload can be embedded in common file formats. Successful exploitation results in arbitrary code execution with the privileges of the current user, which in many enterprise environments means standard user access that can be further escalated. Confidentiality, integrity, and availability are all at risk, as the attacker can execute any code accessible to the user, including data theft, malware installation, and lateral movement tools. The EPSS score of 4.5% (89th percentile) indicates above-average exploitation activity.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-34713 in the wild by adding it to the Known Exploited Vulnerabilities catalog on August 9, 2022, with a remediation deadline of August 30, 2022. The vulnerability is a variant of the widely publicized "Follina" vulnerability (CVE-2022-30190) and has been termed "DogWalk." The EPSS score of 4.5% (89th percentile) indicates significant exploitation probability. The attack vector through crafted documents makes this vulnerability particularly suitable for phishing campaigns, and the public availability of exploitation techniques for MSDT URL protocol attacks lowers the barrier for threat actors.
Remediation
- Apply Microsoft security updates immediately: Install the patches from Microsoft's August 2022 Patch Tuesday that address CVE-2022-34713, as referenced in the Microsoft Security Update Guide.
- Disable the MSDT URL protocol if not needed: As an interim mitigation, disable the MSDT URL protocol handler by deleting the registry key
HKEY_CLASSES_ROOT\ms-msdtto prevent exploitation via URL protocol calls. - Implement email and document filtering: Configure email gateways and endpoint protection to detect and block files that attempt to invoke the MSDT URL protocol, including embedded OLE objects and URL handlers in Office documents.
- Enable Attack Surface Reduction rules: Configure Windows Defender Attack Surface Reduction (ASR) rules to block Office applications from creating child processes, which can prevent the initial execution chain from Office documents to MSDT.
- Educate users about document-based attacks: Provide security awareness training about the risks of opening unexpected documents or files, even from seemingly trusted sources, as this vulnerability relies on user interaction.
Technical Details
CVE-2022-34713 is a remote code execution vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT) triggered through the ms-msdt URL protocol handler. When a calling application such as Microsoft Word invokes MSDT via its URL protocol, the diagnostic tool processes the provided parameters without sufficient input validation. An attacker can craft a malicious document (such as a Word file or RTF document) that contains a reference to the ms-msdt protocol with carefully constructed parameters that cause MSDT to execute arbitrary PowerShell commands or other system commands. The vulnerability is a variant of CVE-2022-30190 ("Follina") and exploits the same fundamental weakness in how MSDT handles URL protocol invocations. The attack requires user interaction in the form of opening the malicious document, but Protected View in Microsoft Office may not fully mitigate the attack if the document is delivered via a path that bypasses this protection.
Frequently Asked Questions
Is CVE-2022-34713 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2022-34713 by adding it to the Known Exploited Vulnerabilities catalog. Also known as "DogWalk," this vulnerability is a variant of the "Follina" MSDT vulnerability and has been observed in real-world attacks. Organizations should apply Microsoft's August 2022 security updates immediately.
What products are affected by CVE-2022-34713?
CVE-2022-34713 affects Microsoft Windows through the Windows Support Diagnostic Tool (MSDT). All Windows versions that include MSDT with the ms-msdt URL protocol handler are potentially vulnerable. Refer to the Microsoft Security Update Guide for the specific list of affected versions.
How do I fix CVE-2022-34713?
Apply the Microsoft security updates from August 2022 that address CVE-2022-34713. As an additional mitigation, consider disabling the MSDT URL protocol handler by removing the HKEY_CLASSES_ROOT\ms-msdt registry key. Enable Attack Surface Reduction rules to prevent Office applications from spawning child processes.
How severe is CVE-2022-34713?
CVE-2022-34713 is a high-severity remote code execution vulnerability with an EPSS score of 4.5% (89th percentile), indicating above-average exploitation probability. While user interaction is required, the attack can be delivered through common phishing vectors, and confirmed active exploitation makes this a high-priority patching item.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.