What does the ARO: Microsoft Windows Support Diagnostic Tool Remote Code Execution Vulnerability mean?

Introduction

Microsoft Windows Support Diagnostic Tool (MSDT) is a legacy service in Windows allowing a technician to analyze diagnostic data remotely.

In April 2022, researchers discovered a security vulnerability in it that allowed remote code execution.

Microsoft recommended disabling it until patched, and has since marked the MSDT platform for decommission in 2025.  Do this for any host running Windows Server 2019 and Windows 10 version 1809 or later (this vulnerability doesn't affect earlier distributions).

As per Microsoft's guidance for CVE-2022-30190, the registry key can be disabled by running the following commands

Step 1

Open the Command Prompt as Administrator.

Step 2

Back up the registry key by executing the command 

reg export HKEYCLASSES_ROOT\ms-msdt [filename]

Step 3

Keep your file [filename] safe

Step 4

reg delete HKEY_CLASSES_ROOT\ms-msdt /f

Step 5

Once Microsoft patches this vulnerability, you can reverse this workaround with the following commands.

reg import [filename]

In addition to this workaround, Field Effect has added detections for exploitation techniques targeting CVE-2022-30190, and will also leverage the detections Microsoft reported adding to Windows Defender.