{"id":64146,"date":"2023-03-07T14:39:48","date_gmt":"2023-03-07T06:39:48","guid":{"rendered":"https:\/\/version-2.com\/?p=64146"},"modified":"2024-09-13T16:31:25","modified_gmt":"2024-09-13T08:31:25","slug":"cve-2022-44666-microsoft-windows-contacts-vcf-contact-ldap-syslink-control-href-attribute-escape-vulnerability","status":"publish","type":"post","link":"https:\/\/version-2.com\/en\/2023\/03\/cve-2022-44666-microsoft-windows-contacts-vcf-contact-ldap-syslink-control-href-attribute-escape-vulnerability\/","title":{"rendered":"CVE-2022-44666: Microsoft Windows Contacts (VCF\/Contact\/LDAP) syslink control href attribute escape vulnerability"},"content":{"rendered":"<div data-elementor-type=\"wp-post\" data-elementor-id=\"64146\" class=\"elementor elementor-64146\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-4da8c5f9 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"4da8c5f9\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;jet_parallax_layout_list&quot;:[{&quot;jet_parallax_layout_image&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;_id&quot;:&quot;decf9c3&quot;,&quot;jet_parallax_layout_image_tablet&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_image_mobile&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_speed&quot;:{&quot;unit&quot;:&quot;%&quot;,&quot;size&quot;:50,&quot;sizes&quot;:[]},&quot;jet_parallax_layout_type&quot;:&quot;scroll&quot;,&quot;jet_parallax_layout_direction&quot;:&quot;1&quot;,&quot;jet_parallax_layout_fx_direction&quot;:null,&quot;jet_parallax_layout_z_index&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x&quot;:50,&quot;jet_parallax_layout_bg_x_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y&quot;:50,&quot;jet_parallax_layout_bg_y_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size&quot;:&quot;auto&quot;,&quot;jet_parallax_layout_bg_size_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_animation_prop&quot;:&quot;transform&quot;,&quot;jet_parallax_layout_on&quot;:[&quot;desktop&quot;,&quot;tablet&quot;]}]}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-133ba185\" data-id=\"133ba185\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-fc2da8d post-content elementor-widget elementor-widget-text-editor\" data-id=\"fc2da8d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><img fetchpriority=\"high\" decoding=\"async\" class=\"alignnone size-full\" src=\"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/cleqaxy4h0z070kqw3r7w3mx3.jpg?tr=w-1800,c-at_max\" width=\"1280\" height=\"720\" \/><\/p><div class=\"col col-md-10 col-12 col-blog\" data-v-85c4bf60=\"\" data-v-0bbc59dc=\"\"><div class=\"news-detail-inner-content\" data-v-85c4bf60=\"\" data-v-0bbc59dc=\"\"><p><a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-44666\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">CVE-2022-44666<\/a> (still 0day) is a <strong>Microsoft Windows Contacts (wab.exe) vulnerability while parsing &#8220;href&#8221; attributes into syslink controls<\/strong>, which was originally discovered, <a href=\"https:\/\/www.zerodayinitiative.com\/advisories\/ZDI-19-013\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">reported through ZDI<\/a> and <a href=\"https:\/\/www.exploit-db.com\/exploits\/46167\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">publicly disclosed<\/a> by <a href=\"https:\/\/twitter.com\/hyp3rlinx\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">John Page (aka hyp3rlinx) of ApparitionSec<\/a> long time ago (~ 5 years). Full credits for discovery go to him!<\/p><p>Last summer I started to study this vulnerability, either finding out further vectors to exploit this by using URL protocol handlers such as search-ms and LDAP, or file types accepted for the latest Windows versions (VCF vs Contact files). Thanks to URL protocols, there are more applications which might trigger the vulnerability (Microsoft Office + remote templates aka linked htmlfile OLE objects, web browsers and even PDF Readers).<\/p><p><img decoding=\"async\" src=\"https:\/\/raw.githubusercontent.com\/j00sean\/CVE-2022-44666\/main\/videos\/ldap-browsers-exploit.gif\" \/><\/p><p>My best contribution was using <strong>LDAP URL protocol<\/strong> which makes the impact a bit higher given that the crafted contact file will be opened without further user interaction for Microsoft Word.<\/p><p>On December 2022, <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2022-44666\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Microsoft decided to release a patch for this vulnerability<\/a> but unfortunately the fix stays incomplete and was easy to find a variant out by using a single char &#8220;@&#8221; before the target payload. <strong>So this vulnerability still remains as 0day nowadays.<\/strong><\/p><p><img decoding=\"async\" src=\"https:\/\/raw.githubusercontent.com\/j00sean\/CVE-2022-44666\/main\/bypass\/videos\/ldap-msword-diagcab-exploit.gif\" \/><\/p><p>There are some caveats for this vulnerability:<\/p><p>\u2705 Windows Contacts application (wab.exe) does not verify MoTW flag.<\/p><p>\u2705 It&#8217;s triggerable by URI protocol LDAP.<\/p><p>\u2705 This file type (.contact) associated by default to Windows Contacts application (wab.exe).<\/p><p>\u2705 Downloads of these file types (.contact &amp; .vcf) aren&#8217;t blocked by browsers, mail servers and so on.<\/p><p>\u274c Syslink control click is necessary to trigger the vulnerability (1-click).<\/p><p>\u274c The payloads have to already be somehow on the target system, this might imply security warnings, MoTW prompts&#8230; What about diagcab files? There are some cons but higher impact occasionally.<\/p><p>\u274c Network share paths as &#8220;href&#8221; attribute are blocked by default.<\/p><p>\u274c Full paths as &#8220;href&#8221; attribute are blocked by default.<\/p><p>Long time ago, <a href=\"https:\/\/0patch.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">0patch<\/a> released a <a href=\"https:\/\/blog.0patch.com\/2019\/01\/one-two-three-micropatches-for-three.html\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">micropatch for this issue<\/a> which has been successfully working with some minor fixes (offsets) in order to cover all the Windows versions, something that, some weeks ago, <a href=\"https:\/\/twitter.com\/0patch\/status\/1626223864996040708\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">has already been deployed<\/a>. It&#8217;s the only unofficial fix which actually is full patching the vulnerability right now, waiting for an official patch that hopefully comes soon.<\/p><p>My full write-up can be found in <a href=\"https:\/\/github.com\/j00sean\/CVE-2022-44666\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">this GitHub repository<\/a> and <a href=\"http:\/\/hyp3rlinx.altervista.org\/advisories\/MICROSOFT_WINDOWS_CONTACT_FILE_RCE_CVE-2022-44666.txt\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">John&#8217;s post in his website<\/a>.<\/p><p>#CVE-2022-44666 #0day<\/p><\/div><div class=\"news-detail-inner-bottom\" data-v-85c4bf60=\"\" data-v-0bbc59dc=\"\"><div class=\"d-flex tags\" data-v-85c4bf60=\"\" data-v-0bbc59dc=\"\"><h4 data-v-85c4bf60=\"\" data-v-0bbc59dc=\"\">Tags<\/h4><ul class=\"tag-list\" data-v-85c4bf60=\"\" data-v-0bbc59dc=\"\"><li class=\"tag\" data-v-85c4bf60=\"\" data-v-0bbc59dc=\"\"><p data-v-85c4bf60=\"\" data-v-0bbc59dc=\"\">#0day<\/p><\/li><li class=\"tag\" data-v-85c4bf60=\"\" data-v-0bbc59dc=\"\"><p data-v-85c4bf60=\"\" data-v-0bbc59dc=\"\">#vicarius_blog<\/p><\/li><li class=\"tag\" data-v-85c4bf60=\"\" data-v-0bbc59dc=\"\"><p data-v-85c4bf60=\"\" data-v-0bbc59dc=\"\">#CVE-2022-44666<\/p><\/li><\/ul><\/div><div class=\"d-flex author\" data-v-85c4bf60=\"\" data-v-0bbc59dc=\"\"><p><img decoding=\"async\" class=\"lazy-image fit-default\" src=\"data:;base64,<svg xmlns=\"http:><\/svg>&#8221; alt=&#8221;users\/photos\/clemvjnl46kz30juk5c0ta59k.jpg&#8221; data-v-5bf3e860=&#8221;&#8221; data-v-85c4bf60=&#8221;&#8221; data-v-0bbc59dc=&#8221;&#8221; \/><\/p><div data-v-85c4bf60=\"\" data-v-0bbc59dc=\"\"><p data-v-85c4bf60=\"\" data-v-0bbc59dc=\"\">Written by<\/p><h4 data-v-85c4bf60=\"\" data-v-0bbc59dc=\"\">j00sean (<a href=\"https:\/\/twitter.com\/j00sean\" rel=\"nofollow\">https:\/\/twitter.com\/j00sean<\/a>)<\/h4><\/div><\/div><\/div><p>\u00a0<\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8085a61 post-content elementor-widget elementor-widget-shortcode\" data-id=\"8085a61\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"shortcode.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-shortcode\">\t\t<div data-elementor-type=\"page\" data-elementor-id=\"18103\" class=\"elementor elementor-18103\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-748947f elementor-section-full_width elementor-section-height-default elementor-section-height-default\" data-id=\"748947f\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;jet_parallax_layout_list&quot;:[{&quot;jet_parallax_layout_image&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;_id&quot;:&quot;c4f773e&quot;,&quot;jet_parallax_layout_image_tablet&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_image_mobile&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_speed&quot;:{&quot;unit&quot;:&quot;%&quot;,&quot;size&quot;:50,&quot;sizes&quot;:[]},&quot;jet_parallax_layout_type&quot;:&quot;scroll&quot;,&quot;jet_parallax_layout_direction&quot;:&quot;1&quot;,&quot;jet_parallax_layout_fx_direction&quot;:null,&quot;jet_parallax_layout_z_index&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x&quot;:50,&quot;jet_parallax_layout_bg_x_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y&quot;:50,&quot;jet_parallax_layout_bg_y_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size&quot;:&quot;auto&quot;,&quot;jet_parallax_layout_bg_size_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_animation_prop&quot;:&quot;transform&quot;,&quot;jet_parallax_layout_on&quot;:[&quot;desktop&quot;,&quot;tablet&quot;]}]}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-7995c19\" data-id=\"7995c19\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a437045 elementor-widget elementor-widget-image-box\" data-id=\"a437045\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><div class=\"elementor-image-box-content\"><h3 class=\"elementor-image-box-title\">About Version 2 Digital<\/h3><p class=\"elementor-image-box-description\">Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.\n<br><br>\nThrough an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t\n\t\t<div data-elementor-type=\"page\" data-elementor-id=\"39690\" class=\"elementor elementor-39690\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-748947f elementor-section-full_width elementor-section-height-default elementor-section-height-default\" data-id=\"748947f\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;jet_parallax_layout_list&quot;:[{&quot;jet_parallax_layout_image&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;_id&quot;:&quot;c4f773e&quot;,&quot;jet_parallax_layout_image_tablet&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_image_mobile&quot;:{&quot;url&quot;:&quot;&quot;,&quot;id&quot;:&quot;&quot;,&quot;size&quot;:&quot;&quot;},&quot;jet_parallax_layout_speed&quot;:{&quot;unit&quot;:&quot;%&quot;,&quot;size&quot;:50,&quot;sizes&quot;:[]},&quot;jet_parallax_layout_type&quot;:&quot;scroll&quot;,&quot;jet_parallax_layout_direction&quot;:&quot;1&quot;,&quot;jet_parallax_layout_fx_direction&quot;:null,&quot;jet_parallax_layout_z_index&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x&quot;:50,&quot;jet_parallax_layout_bg_x_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_x_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y&quot;:50,&quot;jet_parallax_layout_bg_y_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_y_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size&quot;:&quot;auto&quot;,&quot;jet_parallax_layout_bg_size_tablet&quot;:&quot;&quot;,&quot;jet_parallax_layout_bg_size_mobile&quot;:&quot;&quot;,&quot;jet_parallax_layout_animation_prop&quot;:&quot;transform&quot;,&quot;jet_parallax_layout_on&quot;:[&quot;desktop&quot;,&quot;tablet&quot;]}]}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-7995c19\" data-id=\"7995c19\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-ff2a228 elementor-widget elementor-widget-text-editor\" data-id=\"ff2a228\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><\/p>\n<p><b>About VRX<\/b><br><b>VRX&nbsp;<\/b>is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>CVE-2022-44666 (still 0day) is a Microsoft Windows Cont [&hellip;]<\/p>","protected":false},"author":148637484,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[476,1075,61],"tags":[477,1076],"class_list":["post-64146","post","type-post","status-publish","format-standard","hentry","category-vrx","category-year2023","category-press-release","tag-vrx","tag-1076"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2022-44666: Microsoft Windows Contacts (VCF\/Contact\/LDAP) syslink control href attribute escape vulnerability - Version 2<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.vicarius.io\/blog\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2022-44666: Microsoft Windows Contacts (VCF\/Contact\/LDAP) syslink control href attribute escape vulnerability - Version 2\" \/>\n<meta property=\"og:description\" content=\"CVE-2022-44666 (still 0day) is a Microsoft Windows Cont [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.vicarius.io\/blog\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability\" \/>\n<meta property=\"og:site_name\" content=\"Version 2\" \/>\n<meta property=\"article:published_time\" content=\"2023-03-07T06:39:48+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-09-13T08:31:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/cleqaxy4h0z070kqw3r7w3mx3.jpg?tr=w-1800,c-at_max\" \/>\n<meta name=\"author\" content=\"versionpan\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"versionpan\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2023\\\/03\\\/cve-2022-44666-microsoft-windows-contacts-vcf-contact-ldap-syslink-control-href-attribute-escape-vulnerability\\\/\"},\"author\":{\"name\":\"versionpan\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/103ffe36f7fd34a1cc126a30431b94d8\"},\"headline\":\"CVE-2022-44666: Microsoft Windows Contacts (VCF\\\/Contact\\\/LDAP) syslink control href attribute escape vulnerability\",\"datePublished\":\"2023-03-07T06:39:48+00:00\",\"dateModified\":\"2024-09-13T08:31:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2023\\\/03\\\/cve-2022-44666-microsoft-windows-contacts-vcf-contact-ldap-syslink-control-href-attribute-escape-vulnerability\\\/\"},\"wordCount\":416,\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/ik.imagekit.io\\\/14sfaswy6hrz\\\/blog-posts\\\/images\\\/cleqaxy4h0z070kqw3r7w3mx3.jpg?tr=w-1800,c-at_max\",\"keywords\":[\"vRx\",\"2023\"],\"articleSection\":[\"vRx\",\"2023\",\"Press Release\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/version-2.com\\\/2023\\\/03\\\/cve-2022-44666-microsoft-windows-contacts-vcf-contact-ldap-syslink-control-href-attribute-escape-vulnerability\\\/\",\"url\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability\",\"name\":\"CVE-2022-44666: Microsoft Windows Contacts (VCF\\\/Contact\\\/LDAP) syslink control href attribute escape vulnerability - Version 2\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/ik.imagekit.io\\\/14sfaswy6hrz\\\/blog-posts\\\/images\\\/cleqaxy4h0z070kqw3r7w3mx3.jpg?tr=w-1800,c-at_max\",\"datePublished\":\"2023-03-07T06:39:48+00:00\",\"dateModified\":\"2024-09-13T08:31:25+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability#primaryimage\",\"url\":\"https:\\\/\\\/ik.imagekit.io\\\/14sfaswy6hrz\\\/blog-posts\\\/images\\\/cleqaxy4h0z070kqw3r7w3mx3.jpg?tr=w-1800,c-at_max\",\"contentUrl\":\"https:\\\/\\\/ik.imagekit.io\\\/14sfaswy6hrz\\\/blog-posts\\\/images\\\/cleqaxy4h0z070kqw3r7w3mx3.jpg?tr=w-1800,c-at_max\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.vicarius.io\\\/blog\\\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9801\",\"item\":\"https:\\\/\\\/version-2.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2022-44666: Microsoft Windows Contacts (VCF\\\/Contact\\\/LDAP) syslink control href attribute escape vulnerability\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"name\":\"Version 2\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/version-2.com\\\/zh\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\",\"name\":\"Version 2\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"width\":1795,\"height\":335,\"caption\":\"Version 2\"},\"image\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/103ffe36f7fd34a1cc126a30431b94d8\",\"name\":\"versionpan\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/72541e15024f6716236decb252e7488d4a7359d4df6f8506b01f447174f92c7c?s=96&d=identicon&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/72541e15024f6716236decb252e7488d4a7359d4df6f8506b01f447174f92c7c?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/72541e15024f6716236decb252e7488d4a7359d4df6f8506b01f447174f92c7c?s=96&d=identicon&r=g\",\"caption\":\"versionpan\"},\"url\":\"https:\\\/\\\/version-2.com\\\/en\\\/author\\\/versionpan\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2022-44666: Microsoft Windows Contacts (VCF\/Contact\/LDAP) syslink control href attribute escape vulnerability - Version 2","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.vicarius.io\/blog\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability","og_locale":"en_US","og_type":"article","og_title":"CVE-2022-44666: Microsoft Windows Contacts (VCF\/Contact\/LDAP) syslink control href attribute escape vulnerability - Version 2","og_description":"CVE-2022-44666 (still 0day) is a Microsoft Windows Cont [&hellip;]","og_url":"https:\/\/www.vicarius.io\/blog\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability","og_site_name":"Version 2","article_published_time":"2023-03-07T06:39:48+00:00","article_modified_time":"2024-09-13T08:31:25+00:00","og_image":[{"url":"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/cleqaxy4h0z070kqw3r7w3mx3.jpg?tr=w-1800,c-at_max","type":"","width":"","height":""}],"author":"versionpan","twitter_card":"summary_large_image","twitter_misc":{"Written by":"versionpan","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.vicarius.io\/blog\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability#article","isPartOf":{"@id":"https:\/\/version-2.com\/2023\/03\/cve-2022-44666-microsoft-windows-contacts-vcf-contact-ldap-syslink-control-href-attribute-escape-vulnerability\/"},"author":{"name":"versionpan","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/103ffe36f7fd34a1cc126a30431b94d8"},"headline":"CVE-2022-44666: Microsoft Windows Contacts (VCF\/Contact\/LDAP) syslink control href attribute escape vulnerability","datePublished":"2023-03-07T06:39:48+00:00","dateModified":"2024-09-13T08:31:25+00:00","mainEntityOfPage":{"@id":"https:\/\/version-2.com\/2023\/03\/cve-2022-44666-microsoft-windows-contacts-vcf-contact-ldap-syslink-control-href-attribute-escape-vulnerability\/"},"wordCount":416,"publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"image":{"@id":"https:\/\/www.vicarius.io\/blog\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability#primaryimage"},"thumbnailUrl":"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/cleqaxy4h0z070kqw3r7w3mx3.jpg?tr=w-1800,c-at_max","keywords":["vRx","2023"],"articleSection":["vRx","2023","Press Release"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/version-2.com\/2023\/03\/cve-2022-44666-microsoft-windows-contacts-vcf-contact-ldap-syslink-control-href-attribute-escape-vulnerability\/","url":"https:\/\/www.vicarius.io\/blog\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability","name":"CVE-2022-44666: Microsoft Windows Contacts (VCF\/Contact\/LDAP) syslink control href attribute escape vulnerability - Version 2","isPartOf":{"@id":"https:\/\/version-2.com\/zh\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.vicarius.io\/blog\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability#primaryimage"},"image":{"@id":"https:\/\/www.vicarius.io\/blog\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability#primaryimage"},"thumbnailUrl":"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/cleqaxy4h0z070kqw3r7w3mx3.jpg?tr=w-1800,c-at_max","datePublished":"2023-03-07T06:39:48+00:00","dateModified":"2024-09-13T08:31:25+00:00","breadcrumb":{"@id":"https:\/\/www.vicarius.io\/blog\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.vicarius.io\/blog\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.vicarius.io\/blog\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability#primaryimage","url":"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/cleqaxy4h0z070kqw3r7w3mx3.jpg?tr=w-1800,c-at_max","contentUrl":"https:\/\/ik.imagekit.io\/14sfaswy6hrz\/blog-posts\/images\/cleqaxy4h0z070kqw3r7w3mx3.jpg?tr=w-1800,c-at_max"},{"@type":"BreadcrumbList","@id":"https:\/\/www.vicarius.io\/blog\/cve-2022-44666-microsoft-windows-contacts-vcfcontactldap-syslink-control-href-attribute-escape-vulnerability#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9801","item":"https:\/\/version-2.com\/"},{"@type":"ListItem","position":2,"name":"CVE-2022-44666: Microsoft Windows Contacts (VCF\/Contact\/LDAP) syslink control href attribute escape vulnerability"}]},{"@type":"WebSite","@id":"https:\/\/version-2.com\/zh\/#website","url":"https:\/\/version-2.com\/zh\/","name":"Version 2","description":"","publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/version-2.com\/zh\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/version-2.com\/zh\/#organization","name":"Version 2","url":"https:\/\/version-2.com\/zh\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","contentUrl":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","width":1795,"height":335,"caption":"Version 2"},"image":{"@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/103ffe36f7fd34a1cc126a30431b94d8","name":"versionpan","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/72541e15024f6716236decb252e7488d4a7359d4df6f8506b01f447174f92c7c?s=96&d=identicon&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/72541e15024f6716236decb252e7488d4a7359d4df6f8506b01f447174f92c7c?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/72541e15024f6716236decb252e7488d4a7359d4df6f8506b01f447174f92c7c?s=96&d=identicon&r=g","caption":"versionpan"},"url":"https:\/\/version-2.com\/en\/author\/versionpan\/"}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pbQRKm-gGC","post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/64146","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/users\/148637484"}],"replies":[{"embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/comments?post=64146"}],"version-history":[{"count":6,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/64146\/revisions"}],"predecessor-version":[{"id":69398,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/64146\/revisions\/69398"}],"wp:attachment":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/media?parent=64146"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/categories?post=64146"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/tags?post=64146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}