CVE-2022-34713

What it actually does

This vulnerability allows remote code execution through Microsoft Windows Support Diagnostic Tool (MSDT) when a user is induced to open or interact with a malicious diagnostic package or related content. The flaw can be abused to cause MSDT-related components such as msdt.exe or diagnostic host processes to place or execute attacker-controlled content in the context of the victim user. Successful exploitation can compromise confidentiality, integrity, and availability of the affected Windows system. Although the CVSS vector lists local attack characteristics, practical exploitation commonly depends on social engineering, such as delivering a malicious file by email, web download, chat, or removable media and convincing the user to open it.

Why it matters to the business

A successful attack can give an adversary code execution on employee workstations or servers, enabling credential theft, malware deployment, lateral movement, data access, and disruption of business operations. This issue is listed in CISA KEV with active exploitation in the wild and had a federal remediation deadline of 2022-08-30, so any remaining exposure should be treated as overdue and high priority. The provided affected-product metadata references jenkinsci/jenkins, which appears inconsistent with the Microsoft Windows MSDT vulnerability description; organizations should validate asset and SBOM mappings to avoid missing Windows endpoints because of incorrect package attribution.

How an attack unfolds

An attacker prepares malicious diagnostic content that abuses MSDT behavior to write or execute attacker-controlled code. The attacker then delivers the content to a target through a phishing email, web link, file share, collaboration platform, or other channel. When the victim opens the malicious diagnostic package or associated file, Windows invokes MSDT or related diagnostic host components. The malicious content causes code or a payload to be staged or executed under the victim user's privileges. From there, the attacker may establish persistence, run discovery commands, steal credentials or tokens, deploy additional tooling, and attempt lateral movement to higher-value systems.

How to fix it

Apply the Microsoft security updates that address CVE-2022-34713 on all supported Windows systems. Because this vulnerability is in CISA KEV and has been actively exploited, prioritize patching internet-facing, high-risk, privileged-user, VDI, jump-host, and administrative workstations. Where immediate patching is not possible, restrict delivery and execution of diagnostic cabinet/package files, block untrusted .diagcab content, harden attachment handling, and use endpoint controls to monitor or restrict suspicious msdt.exe and diagnostic host process behavior. Review Microsoft guidance for MSDT protocol-handler hardening and any relevant workarounds appropriate to the Windows version in use. The supplied fixed-version list references jenkinsci/jenkins fixed at commit 721f445841ca8c6f29cb314e2dedddf0949461ed; because that does not align with the Microsoft Windows MSDT vulnerability description, validate whether this is a data-enrichment error before using it as remediation evidence for this CVE.

How to confirm the fix worked

Confirm that all supported Windows assets have the applicable August 2022 or later Microsoft security updates installed, or the specific cumulative update that includes the MSDT fix for the operating system build. Validate through vulnerability scanning, endpoint inventory, patch-management reporting, and OS build/KB verification. Test endpoint controls by confirming that untrusted diagnostic package execution is blocked or alerted, and that suspicious msdt.exe or sdiagnhost.exe activity is logged. Reconcile vulnerability-management findings with asset inventory to ensure Windows endpoints are not incorrectly excluded because of the inconsistent Jenkins package metadata in the input.

Typical attack path

1. Identify Windows users likely to open diagnostic packages, attachments, or downloaded files.
2. Deliver a malicious file or link through phishing, web download, chat, file share, or removable media.
3. Rely on user interaction to open the malicious content.
4. Trigger MSDT or related diagnostic host execution on the victim system.
5. Stage or execute attacker-controlled code in the user context.
6. Establish persistence, commonly through user-writable startup locations or scheduled execution mechanisms.
7. Perform host discovery, credential access, data collection, and lateral movement as permitted by the compromised user's privileges.

How to detect it

To determine whether exploitation already occurred, review endpoint telemetry, EDR process trees, Windows event logs, file-creation events, email security logs, web proxy logs, and file-share audit logs. Focus on msdt.exe, sdiagnhost.exe, and related diagnostic components launched shortly after a user opened a downloaded or emailed file. Look for .diagcab files arriving through email attachments, browser downloads, collaboration tools, or file shares. Hunt for diagnostic processes creating or modifying files in user Startup folders, Temp directories, Downloads directories, or other user-writable locations. Review process ancestry for Office applications, browsers, archive tools, email clients, or Explorer spawning msdt.exe or diagnostic host processes. Investigate any child processes from MSDT-related components, especially cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, or network-capable payloads. Correlate suspicious activity with outbound connections, credential-access alerts, persistence creation, new scheduled tasks, registry Run keys, and unusual authentication from the affected user account. Threat activity is known to exist in the wild for this KEV-listed vulnerability, so absence of ransomware designation should not reduce hunting priority.

• msdt.exe
• sdiagnhost.exe
• .diagcab
• msdt.exe /cab
• msdt.exe -cab
• ms-msdt:
• %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
• %PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
• \Microsoft\Windows\Start Menu\Programs\Startup\
• AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
• Downloads\*.diagcab
• Temp\*.diagcab
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• wscript.exe
• cscript.exe
• mshta.exe
• rundll32.exe
• regsvr32.exe
• certutil.exe -urlcache
• bitsadmin.exe
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• HKLM\Software\Microsoft\Windows\CurrentVersion\Run

What your security team should do

• Treat this as an urgent, overdue KEV item: identify and patch all affected Windows systems immediately.
• Validate asset attribution and SBOM mappings because the provided Jenkins affected-product metadata appears inconsistent with the Microsoft Windows MSDT issue.
• Hunt for suspicious msdt.exe, sdiagnhost.exe, and diagnostic package activity, especially around user Downloads, Temp, email attachment cache, browser cache, and Startup folders.
• Create detections for diagnostic host processes creating files in user Startup directories or launching script interpreters, command shells, Office child processes, or unusual network connections.
• Block or quarantine untrusted .diagcab files at email, web proxy, EDR, and file-sharing control points where feasible.
• Review recent phishing, attachment, and endpoint alerts for signs of malicious diagnostic package delivery or execution.
• Prioritize forensic review on endpoints used by privileged users or systems that showed suspicious diagnostic tool activity before patching.