# DOCX template injection via CVE-2017-0199

Published: 2025-07-17 · Severity: elevated
Canonical: https://vorant.io/reports/b0aae8d3-2601-5e62-b9c0-47420d51a987/docx-template-injection-via-cve-2017-0199

> CISA reports a malicious DOCX file exploiting CVE-2017-0199 to download external Word templates from a private IP.

CISA analysis identified a Microsoft Word DOCX file designed to exploit CVE-2017-0199, a known vulnerability in Office's external template loading mechanism. The malicious document contains a modified settings.xml.rels file pointing to an external template URL (hxxp://192.168.10.102/1.doc) and attempts to deceive users into enabling macros, though the document contains no actual macros. When opened in Microsoft Word, the application will attempt to fetch the template from the specified private IP address, potentially delivering malware or additional payloads. The template URL points to a private RFC1918 address, suggesting this was a targeted or internal attack. The actual template file was not available for analysis at the time of this report. CVE-2017-0199 is a remote code execution vulnerability in Microsoft Office that allows attackers to execute arbitrary code through specially crafted Office documents that reference external resources.

## Mentioned in this report

- Vulnerabilities: CVE-2017-0199 (KEV)
- Malware: CVE-2017-0199 Downloader

## Detection guidance (public sample)

### Word Process Connecting to Private IP over HTTP (Remote Template Fetch)

ATT&CK: T1559.001

WINWORD.EXE opening an outbound HTTP connection to an RFC1918 address, consistent with CVE-2017-0199 style external template loading from a settings.xml.rels reference. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Word Process Connecting to Private IP over HTTP (Remote Template Fetch)
description: Detects WINWORD.EXE initiating an outbound connection on common HTTP
  ports to an RFC1918 address. Word fetching a remote template/document this way is
  typical of CVE-2017-0199 template injection (external template URL in settings.xml.rels).
  Generalises on process, port and private destination range, not on a specific IP
  or file name.
status: experimental
tags:
- attack.execution
- attack.t1559.001
- attack.t1204.002
- attack.initial-access
- attack.t1566.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \WINWORD.EXE
    Initiated: 'true'
    DestinationPort:
    - 80
    - 8080
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection
falsepositives:
- Users opening documents or templates hosted on internal HTTP-only intranet or SharePoint
  servers
- Internal document management systems that serve templates over plain HTTP
level: medium
id: e84dbd9f-12f4-5e46-a5ca-a22fc7347aad
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133h
```

### Office Application Spawning Script or LOLBin Child Process

ATT&CK: T1204.002

Word, Excel or PowerPoint spawning mshta, script hosts, shells or download LOLBins - typical post-exploitation of CVE-2017-0199 and malicious document execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Script or LOLBin Child Process
description: Detects Microsoft Office applications spawning scripting hosts, command
  shells or download/proxy-execution binaries. This is the typical follow-on stage
  after an Office document exploits CVE-2017-0199 and retrieves a remote payload (for
  example HTA or script content).
status: experimental
tags:
- attack.execution
- attack.t1204.002
- attack.t1559.001
- attack.initial-access
- attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    Image|endswith:
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
    - \powershell.exe
    - \pwsh.exe
    - \cmd.exe
    - \regsvr32.exe
    - \rundll32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Legitimate Office macros or add-ins that invoke cmd.exe or PowerShell for business
  automation
- Software deployment or reporting tools that drive Office through scripts
level: high
id: 30bace5c-52bb-51a1-8518-936929b1f49c
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133h
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-133h

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b0aae8d3-2601-5e62-b9c0-47420d51a987/docx-template-injection-via-cve-2017-0199.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup