Information Disclosure in Microsoft XML Core Services (CVE‑2017‑0022) Enables Remote File Probing
What It Is — MSXML mishandles in‑memory objects, allowing a remote attacker to craft a web page that can test for the existence of arbitrary files on the victim’s disk.
Exploitability — Publicly disclosed; proof‑of‑concept code is available. The vulnerability is rated Moderate (CVSS v3 ≈ 5.5). No known active exploit campaigns, but the low barrier to weaponisation makes it a realistic threat.
Affected Products — Microsoft XML Core Services (MSXML) 6.0 and earlier versions shipped with Windows 7, Windows Server 2008 R2, and Windows 10. Any application that relies on the vulnerable MSXML library is potentially exposed.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous component‑level vulnerability monitoring to prove due diligence in supply‑chain risk management.
- Provides evidence that control owners must capture and retain patch‑status data to satisfy audit queries on “software integrity.”
- Highlights the importance of control mapping: a single library flaw can impact multiple framework objectives (e.g., asset management, vulnerability remediation) across SOC 2, ISO 27001, NIST CSF, etc.
Recommended Actions
- Verify the MSXML version on all Windows endpoints and servers; upgrade to the patched version released by Microsoft (or apply the supplied security update).
- Integrate MSXML patch status into your continuous vulnerability‑scanning pipeline and map the finding to the “Vulnerability Management” control area in your chosen framework.
- Document remediation evidence (patch logs, scan reports) in a centralized Trust Center to support audit readiness.
Source: CISA Known Exploited Vulnerabilities (KEV) – CVE‑2017‑0022