CVE-2021-33742

What it actually does

CVE-2021-33742 is a remote code execution vulnerability in the Windows MSHTML browser engine caused by memory corruption when MSHTML processes specially crafted web content. Because MSHTML is used not only by Internet Explorer but also by applications that embed or invoke the Windows HTML rendering engine, exploitation can occur through malicious web pages, documents, or application content that cause the engine to parse attacker-controlled HTML/script. Successful exploitation allows code execution in the context of the user who opens or previews the malicious content, enabling data theft, payload execution, persistence setup, or lateral movement depending on user privileges and endpoint controls.

Why it matters to the business

This vulnerability affects many supported and legacy Windows desktop and server versions, including Windows 7, 8.1, 10, Windows RT 8.1, and Windows Server 2008 through 2019. It is listed in CISA KEV with a remediation deadline of 2021-11-17, has active in-the-wild exploitation, and has been associated with Candiru/SOURGUM/DevilsTongue activity, making unpatched systems a credible target for espionage or targeted compromise. Operationally, exploitation can lead to endpoint takeover, credential and document theft, malware deployment, disruption of business workflows, and compromise of privileged workstations if users open malicious content.

How an attack unfolds

An attacker prepares HTML, script, or document-delivered content designed to trigger memory corruption in the Windows MSHTML engine. The attacker then delivers the content through a phishing email, malicious link, compromised website, embedded browser control, or document that causes MSHTML to render attacker-controlled markup. A user must interact by opening the link, document, or application content, which is why the CVSS vector includes user interaction and high attack complexity. If exploitation succeeds, shellcode or a staged payload executes under the victim user's security context. The attacker commonly follows with command-and-control beaconing, payload download, credential collection, browser/session data theft, surveillance tooling, or persistence. Public reporting links exploitation to Candiru/SOURGUM/DevilsTongue-style targeted operations, so attacks may be low-volume and tailored rather than noisy mass exploitation.

How to fix it

Apply the Microsoft security updates released for CVE-2021-33742 for all affected Windows client and server versions. Because no fixed version list was provided, use the applicable Microsoft June 2021 or later cumulative/security update for each OS line, and ensure systems are current with supported cumulative updates. Prioritize internet-facing systems, administrator workstations, VDI/golden images, jump boxes, email-heavy user endpoints, and legacy Windows systems. Remove or isolate unsupported Windows versions where patches are unavailable. As compensating controls, restrict Internet Explorer/MSHTML exposure where feasible, harden Office and email handling of active content, disable or limit preview panes for untrusted documents, enforce application control, block suspicious script interpreters spawned from Office/browser processes, and ensure endpoint protection has behavioral exploit mitigations enabled.

How to confirm the fix worked

Confirm that all affected Windows systems have the relevant Microsoft security update installed using Windows Update, WSUS, Microsoft Configuration Manager, endpoint management tooling, or vulnerability scanning authenticated to the host. Validate that OS build numbers and installed KBs correspond to June 2021 or later cumulative updates for the relevant Windows release. Re-scan for CVE-2021-33742 after patch deployment and verify unsupported operating systems are retired, isolated, or otherwise covered by compensating controls. Test email and web controls by confirming that untrusted documents, active content, and suspicious child processes from browser or Office applications are blocked or alerted. For legacy systems, document residual exposure and verify network segmentation and least-privilege controls reduce the impact of user-context code execution.

Typical attack path

1. Identify target users or systems likely to open web or document content on affected Windows versions.
2. Craft malicious HTML/script or document content that invokes the MSHTML engine and triggers the memory-corruption condition.
3. Deliver the content using spear phishing, a malicious link, a compromised website, or a document opened by the victim.
4. Victim opens or previews the content, causing MSHTML to parse attacker-controlled data.
5. Exploit code achieves execution in the context of the logged-on user.
6. Drop or execute a second-stage payload, often via script interpreters, LOLBins, or in-memory loaders.
7. Establish command-and-control, collect credentials or sensitive files, and attempt persistence or lateral movement as privileges permit.

How to detect it

To determine whether exploitation already occurred, review endpoint and network telemetry for suspicious activity immediately after a user opened a link, email attachment, or document. Relevant sources include EDR process trees, Windows Security logs, Sysmon logs, PowerShell logs, browser history/cache, Office telemetry, email gateway logs, proxy logs, DNS logs, web filtering logs, and antivirus/exploit-prevention events. Look for Internet Explorer, embedded browser controls, Office applications, or document viewers spawning script interpreters, command shells, rundll32/regsvr32/mshta, download utilities, or unknown executables. Investigate crashes in iexplore.exe or applications hosting MSHTML followed by payload execution. Since exploitation has been tied to Candiru/SOURGUM/DevilsTongue, also hunt for targeted delivery artifacts, low-volume phishing, unusual browser exploit crashes, surveillance tooling, credential access, persistence changes, and outbound connections to rare or newly observed domains after content rendering. Correlate email/proxy events with endpoint process creation within minutes of the user interaction.

• iexplore.exe spawning cmd.exe
• iexplore.exe spawning powershell.exe
• iexplore.exe spawning wscript.exe
• iexplore.exe spawning cscript.exe
• iexplore.exe spawning mshta.exe
• iexplore.exe spawning rundll32.exe
• iexplore.exe spawning regsvr32.exe
• winword.exe spawning mshta.exe
• winword.exe spawning powershell.exe
• winword.exe spawning cmd.exe
• excel.exe spawning mshta.exe
• powerpnt.exe spawning mshta.exe
• outlook.exe spawning mshta.exe
• mshta.exe spawning powershell.exe
• mshta.exe spawning cmd.exe
• mshtml.dll
• Windows Error Reporting event for iexplore.exe application crash
• Faulting module name: mshtml.dll
• Event ID 4688 with parent process iexplore.exe and child process powershell.exe
• Event ID 4688 with parent process iexplore.exe and child process mshta.exe
• Event ID 4688 with parent process winword.exe and child process powershell.exe
• Sysmon Event ID 1 with ParentImage ending in \\iexplore.exe and Image ending in \\powershell.exe
• Sysmon Event ID 1 with ParentImage ending in \\winword.exe and Image ending in \\mshta.exe

What your security team should do

• Immediately inventory Windows endpoints and servers for affected OS versions and confirm installation of Microsoft security updates addressing CVE-2021-33742.
• Treat unpatched systems as high priority because the vulnerability is in CISA KEV, has active exploitation, and is associated with Candiru/SOURGUM/DevilsTongue activity.
• Prioritize patching of user workstations, administrator endpoints, terminal servers, VDI images, and systems used to open email, web, or document content.
• Hunt for historical exploitation using browser, Office, email gateway, EDR, proxy, DNS, and process-creation telemetry around suspicious MSHTML-triggered content and abnormal child processes.
• Harden phishing and document execution paths by blocking active content from the internet, disabling risky preview behavior, and alerting on Office/browser processes spawning scripting utilities or downloaders.
• Retire, isolate, or tightly segment unsupported Windows 7/Server 2008-class systems that cannot receive current security updates.
• Review endpoint detections for known Candiru/SOURGUM/DevilsTongue tradecraft and unusual surveillance, credential theft, or C2 behaviors following document or web-content execution.