CVE-2017-0022 is an information disclosure vulnerability in Microsoft XML Core Services. CISA added it to the Known Exploited Vulnerabilities catalogue on 24 May 2022, which means attackers have used it in real attacks. Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.
What the vulnerability means in practice
CVE-2017-0022 is an information disclosure flaw in Microsoft XML Core Services. In practice, that means a remote attacker can use a crafted web page to probe for local files on a victim system, turning a browser visit into an information-leak opportunity rather than a visible crash or denial of service.
The dangerous part is not just the leak itself, but the signal it can provide to an attacker. Being able to confirm whether files exist on disk can help an adversary map software presence, refine targeting, and chain the flaw with other weaknesses. For broader vulnerability triage and prioritisation context, see the NIST National Vulnerability Database and the CVE Program.
Why information disclosure matters
Information disclosure bugs are often underestimated because they do not always give direct code execution. Even so, file-existence checks can expose deployment details, reveal which applications or components are present, and help an attacker move from blind probing to informed exploitation. That reconnaissance value is what makes the issue security-relevant, especially on systems that still expose legacy browser-facing components.
In the Microsoft XML Core Services case, the risk is amplified by the fact that the flaw is reachable through web content. A user only has to load the malicious page for the attacker to get a response from the local environment, so the security boundary being crossed is the one between browser content and local system state.
How organisations check exposure and scope
Exposure review starts with asset inventory: identify where Microsoft XML Core Services is installed, which endpoints still allow web browsing, and whether those systems are reachable by untrusted content. Organisations should then confirm whether the issue is already listed in their vulnerability management workflow and whether the asset appears in KEV-driven prioritisation. A useful starting point for that process is the Vulnerability Management Guide, which ties asset scope, KEV, and remediation prioritisation together.
Checking vendor advisory guidance is also important because version and patch details should come from the vendor rather than from the CVE entry itself. If the affected software is present on internet-facing or user-facing machines, organisations should treat the exposure as higher priority than the same issue on isolated or well-restricted systems.
Remediation, detection, and post-exploitation review
Remediation should follow the vendor advisory and the CISA KEV catalogue for authoritative patch guidance. Where patching is delayed, organisations should narrow exposure by removing unnecessary browser access, limiting where the component is installed, and reducing the ability of untrusted web content to interact with vulnerable hosts. If the environment cannot be patched immediately, compensating controls should focus on reducing reachability and opportunity, not on assuming the bug is harmless because it is only informational.
Detection should focus on suspicious web activity involving crafted pages, unusual requests that probe local-file existence, and correlated signs that a host may have been targeted after browsing. Because exploitation may be used as a reconnaissance step, post-patch review should include checking whether the same host showed follow-on abuse, such as credential theft, staging activity, or later exploitation through another vector. If a compromise is suspected, review browser sessions, downloaded content, and nearby telemetry for signs of chained activity.
Risk and Threat Considerations
This flaw is risky because information leakage often becomes an enabler for a broader intrusion. File-existence probing can tell an attacker which software, paths, or local conditions are present, which makes subsequent exploitation more accurate and harder to defend against.
Failure mechanism: A malicious website triggers MSXML to reveal whether specific files exist on the local system, turning a browser interaction into an oracle for local state.
Impact: Attackers can use the disclosed information for reconnaissance, targeting, and attack chaining, especially on systems that expose legacy components to web content.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Asset Inventory | Asset inventory is needed to find where MSXML is installed and exposed. |
| PR.DS-01 — Data-at-rest is protected | Local file exposure can reveal protected data on disk, so data protection is directly implicated. | |
| Recommendation — Inventory hosts running MSXML and prioritize remediation for exposed assets. Protect sensitive local files and reduce what an attacker can learn from file presence. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | This CVE requires continuous vulnerability discovery and exposure tracking. |
| SI-2 — Flaw Remediation | The issue is a known vulnerability that requires tracked remediation and patch verification. | |
| Recommendation — Continuously scan for MSXML exposure and track remediation until closed. Remediate the MSXML flaw promptly and verify the fix across all affected hosts. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | CISA KEV-listed flaws belong in continuous vulnerability management and prioritization. |
| Recommendation — Prioritize this KEV-listed CVE in your vulnerability management program. | ||
Practitioner Guidance
Why practitioners should care: Treat this as a prioritisation issue, not a low-value leak. Information disclosure on an exposed client or server component can materially improve an attacker’s next step, even when the immediate payload is limited.
What to watch for: Focus on systems that still rely on legacy Microsoft components, receive untrusted web content, or have weak asset visibility. Those are the systems most likely to be missed in remediation tracking and most likely to provide useful reconnaissance to an attacker.