I calc'd Calc

I calc'd Calc: Exploiting Excel Online and Cloud Office Security

**Overview**

Nicholas Jolie, security researcher at Microsoft Security Response Center (MSRC), presents research on exploiting Excel Online, the cloud version of Microsoft's spreadsheet application. The talk addresses a critical question: if desktop Office applications have a history of exploitable vulnerabilities despite mitigations, can the cloud-based Office Online service also be compromised? Jolie conducted a summer 2018 research project investigating the feasibility of remote code execution (RCE) against Excel Online—a complex attack surface involving hundreds of interacting services running on Windows infrastructure. The research moves beyond simply asking whether Office Online can be exploited; it explores how to systematically find vulnerabilities in a mature, heavily-audited codebase, what types of bugs might bypass cloud-based mitigations, and what architectural improvements could make Office Online a harder target for attackers. By attempting to exploit Excel Online, Jolie sought to understand whether bugs affecting desktop Excel would also affect the online version, and if so, what exploitation techniques would work against cloud mitigations like ASLR and address space layout randomization.

**Technical Details**

Microsoft Office Vulnerability History:

1. **Desktop Office Exploits**: - Office exploits targeting COM monikers and Windows components have been observed; few recent pure-Office exploits - Historical Office Embedded PostScript (EPS) font parser exploits existed years ago - Office equation editor contained stack overflow vulnerabilities with minimal mitigations (no DEP/ASLR in affected component) - Office core functionality exploits are relatively rare compared to Windows component exploits

2. **Office Online Prior to 2018**: - Limited known exploits targeting Office Online before this research - Uninitialized memory issues in GDI (Graphics Device Interface) reported by Google researchers, discoverable via Office documents - Conceptually different threat model: desktop Office is user-downloaded and executed locally; Office Online processes documents on remote servers - Bug reported as Office vulnerability was initially dismissed as non-critical for desktop customers but proved critical for Office Online

Office Online Infrastructure Architecture:

3. **Office Online Server Components**: - IIS (Internet Information Services) web server running on Windows infrastructure - Hundreds of services simultaneously running in Office Online environments (500+ in test VMs; less in production) - Multiple service interactions creating complex attack surface - Office Online processes documents from untrusted sources (email attachments, cloud storage)

4. **Excel Online Service Specifics**: - Massive DLL containing most of Excel desktop core functionality compiled for server environment - If desktop Excel vulnerability exists, it likely exists in Excel Online due to shared code - Server-side rendering: processes documents, outputs rendered content to browsers - Use cases: viewing email attachments in Outlook Web Access, collaborative cloud editing, document preview scenarios

5. **Office Online vs Office On-Premises vs Cloud Office**: - **Office Online (Cloud)**: Public cloud service, no public access for testing, most restricted - **Office Online Server (On-Premises)**: Downloadable version for enterprise; installable with Visual Studio subscriptions for older builds; more recent builds require volume licensing - Vulnerability in desktop Office often affects both versions due to shared code

Research Methodology and Challenges:

6. **Research Questions**: - Feasibility: Can remote code execution be achieved against Office Online? - Effort: How much time/resources required? Need insider knowledge/symbols/information? - Mitigation Effectiveness: What architectural improvements could make Office Online harder to exploit?

7. **Target Selection Rationale**: - Prior experience with Excel vulnerabilities from previous employment (ViewPen Security) - Already familiar with Excel internals, had ideas for complex exploits never previously attempted - Wanted to leverage Microsoft resources (symbols, source code access) for deep analysis

8. **Vulnerability Finding Strategy**: - Fuzzing consideration: Excel codebase audited by Microsoft internally and external researchers for 20+ years; value of indiscriminate fuzzing questionable - Bug hunting approach: What types of bugs would be valuable? Need mitigations bypass potential - Mitigation landscape: ASLR, DEP, Control Flow Guard employed in Office Online; simple exploits insufficient

9. **Exploit Patterns in Office**: - "One-shot exploits": Single malicious file triggering complicated exploit chain that bypasses multiple mitigations simultaneously; rare but possible - Example: heap corruption exploits leveraging image format parsing; multiple primitives chained in single payload - Desktop Office mitigations have driven attackers to multi-primitive, multi-stage exploits

10. **Key Differences: Desktop vs Cloud**: - Desktop Office: User runs application locally, malicious document executes with user privileges - Office Online: Document processed on server with web service privileges; output sent to browser; attacker may not need user interaction - Server context changes privilege model: RCE on Office Online service process is critical even if user has no direct interaction

**Defense & Takeaways**

Securing Office Online against exploitation: (1) Apply exploits from desktop Office context to cloud—recognize that vulnerabilities in shared code (Excel DLL) affect both desktop and online; prioritize patches for shared functionality; (2) Understand cloud attack surface—Office Online involves hundreds of interacting services; vulnerability in any service potentially exploitable; treat document processing as untrusted input; (3) Implement comprehensive input validation—documents processed by Office Online come from email, cloud storage, user uploads; validate document structure before processing; use sandboxing; (4) Deploy sandboxing for document processing—run Excel/Word/PowerPoint processing in restricted processes; limit process privileges; prevent lateral movement to core services; (5) Enforce strict mitigations—implement ASLR, DEP, Control Flow Guard on all Office Online processes; disable legacy features that break mitigations; (6) Create detailed symbol/source control—symbols enable reverse engineers; restrict internal symbol distribution; limit insider vulnerability discovery advantage; (7) Conduct targeted auditing—instead of indiscriminate fuzzing of 20-year-old codebase, focus on high-risk areas: file parsing, memory operations, external input handling; (8) Implement exploit telemetry—detect exploitation attempts against Office Online; monitor for unusual patterns in document processing, memory access, service behavior; (9) Enable memory protection—use guard pages, stack cookies, heap metadata validation; limit exploitation primitives available to attackers; (10) Restrict capability model—Office Online processes should have minimal required capabilities; if document rendering doesn't need network access, disable it; (11) Implement crash reporting—crashes in Office Online may indicate exploitation attempts; collect dumps, analyze for vulnerability patterns; (12) Maintain rapid patching velocity—shared code means patch applies to both desktop and cloud; deploy patches to Office Online quickly; communicate patch priority to customers; (13) Threat modeling by component—systematize Office Online component analysis; identify which services are trusted vs untrusted; prioritize security review by component; (14) Researcher engagement—enable responsible disclosure for Office Online; provide test environments for researchers; learn from disclosed bugs to improve architecture; (15) Consider architectural redesign—after years of exploitation patterns, consider redesigning document processing architecture; move parsing to separate untrusted process; implement defense-in-depth rather than single-layer protection. The critical insight: Cloud-based Office faces a different threat model than desktop. While desktop exploits often require user execution and context-specific privileges, Office Online processes untrusted documents from mail systems and cloud storage at scale. Bugs that might be low-severity on desktop become critical on cloud services. The shared codebase—Excel Online is essentially Excel desktop DLL running on servers—means vulnerabilities cross both platforms. Defenders must treat Office Online as a high-value attack surface requiring multiple layers of defense: input validation, sandboxing, mitigations, telemetry, and rapid response. A single exploitable vulnerability in document processing could compromise hundreds of thousands of users' documents simultaneously, making Office Online an attractive target despite its complexity and defensive measures.