CVE-2021-21958

Executive Summary

CVE-2021-21958 is a heap-based buffer overflow vulnerability in the Hword component (HwordApp.dll) of Hancom Office 2020 version 11.0.0.2353. Successful exploitation requires the victim to open a specially crafted malformed file, which can lead to memory corruption and potential arbitrary code execution within the context of the application. Hancom Office is a widely used office productivity suite in South Korea and other Asian markets, and exploitation of this flaw could allow an attacker to compromise the victim's system, steal credentials, or deploy further malware. As of the data available, no patch has been released, and the vulnerability remains unpatched.

Technical Analysis

The vulnerability resides in the HwordApp.dll library, which is responsible for the word-processing (Hword) module within Hancom Office 2020. The NVD description classifies this as a heap-based buffer overflow. Heap-based buffer overflows occur when a program writes more data to a heap-allocated memory buffer than the buffer was allocated to hold. This typically results from insufficient bounds checking when processing input data — in this case, a specially crafted malformed document file.

The attack surface for this vulnerability is the file-parsing functionality of the Hword document processor. An attacker crafts a malformed file (likely an HWP, HWT, DOCX, or other document format supported by Hancom Office) that, when parsed by HwordApp.dll, triggers an out-of-bounds write on the heap. The specific code path or function within HwordApp.dll responsible for the overflow is not disclosed in the available CVE data. The NVD description references the library filename HwordApp.dll but does not provide a specific function name or code-level detail.

The overflow can "lead to memory corruption and potential arbitrary code execution," indicating that the classic heap corruption exploitation primitives apply. These primitives typically involve techniques such as heap spraying to place attacker-controlled data at predictable heap addresses, or overwriting heap metadata (e.g., Linux glibc chunk headers or Windows heap structures) to achieve an arbitrary write primitive, which can then be leveraged to redirect execution flow to shellcode or to a ROP chain.

Because the vulnerability is triggered during file parsing — a user-assisted interaction — the attack chain requires zero network services exposure. The vulnerable component is the document parser itself, which processes content such as text runs, embedded objects, images, tables, or other structured data elements. Without a vendor advisory or a researcher analysis detailing the exact vulnerable code path, the specific data element that triggers the overflow is unknown. Insufficient technical detail is available from the public CVE record beyond the vulnerability class and the component library.

It is important to note that the CVSS score is 7.8 (High), and although the CVSS vector string was not provided, the score implies a local attack vector requiring user interaction (AV:L/PR:N/UI:R/S:U/C:H/I:H/A:H). This is consistent with a "malicious file must be opened by the user" scenario.

Exploitation Scenarios

The attack chain for CVE-2021-21958 is inferred from the vulnerability class (heap-based buffer overflow in a document parser) and the NVD description. No public PoC or exploit code is currently available, so the steps below are generalized scenarios applicable to this class of vulnerability.

Step 1: Reconnaissance / Target Identification The attacker identifies organizations or individuals that use Hancom Office 2020, version 11.0.0.2353. Hancom Office is a dominant office suite in South Korea, widely deployed across government agencies, enterprises, and academic institutions. Attackers may use sector-specific threat intelligence or publicly available data to select high-value targets. In a phishing campaign, the attacker can deliver the malicious file via email, instant messaging, or by hosting it on a shared drive or website.

Step 2: Triggering the Vulnerable Flaw The attacker crafts a malformed document file that contains a specific structural anomaly designed to trigger the heap-based buffer overflow in HwordApp.dll during parsing. The victim must open the file (e.g., clicking an attachment in an email, downloading and opening a file from a web page, or opening a file from a shared network location). No authentication or special privileges are required beyond the ability to open the file in Hancom Office.

Step 3: Payload / Execution Method (Vulnerability-Class Level) Upon parsing the malformed file, the heap overflow corrupts memory. The attacker can attempt to exploit the corruption to achieve arbitrary code execution by:

• Heap spraying: Allocating and filling heap memory with attacker-controlled data (e.g., shellcode or ROP gadgets) to increase the likelihood that the overflow overwrites a function pointer, return address, or heap metadata with attacker-controlled data.
• Overwriting heap metadata: Corrupting Windows heap chunk headers to achieve an arbitrary write primitive, then leveraging it to overwrite a critical pointer (e.g., a vtable pointer, exception handler, or stack return address), redirecting execution to attacker-controlled code.
• DEP/ASLR bypass: Using ROP chains or JIT spraying to bypass standard mitigation such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR). This is a standard prerequisite for reliable exploitation on modern Windows systems.

Once code execution is achieved, it runs in the context of the Hancom Office process, with the privileges of the logged-in user.

Step 4: Post-Exploitation Impact Post-exploitation impact includes:

• Full user-level compromise of the victim's workstation.
• Credential theft via keylogging, memory scraping, or accessing locally stored credentials.
• Lateral movement within the enterprise network if the compromised host has network access to other systems.
• Deployment of ransomware, spyware, or backdoors.
• Data exfiltration from files accessible to the user.

Note: No public PoC is available at the time of this reporting; the attack chain above is inferred from the heap buffer overflow vulnerability class and the NVD description. The specific document format, file structure, and the exact parser code path that triggers the overflow are not disclosed in the available data.

Impact Assessment

Business Impact: This vulnerability has a CVSS base score of 7.8 (High), with subscores of High confidentiality impact (C:H), High integrity impact (I:H), and High availability impact (A:H). Successful exploitation allows an attacker to fully compromise the victim's workstation, which can cascade into broader network compromise.

Affected Systems: Hancom Office 2020 version 11.0.0.2353 (the Hword module — HwordApp.dll). The vendor has not yet released a patch, leaving all users of this version vulnerable.

Blast Radius:

• User base: Hancom Office is the dominant office productivity suite in South Korea, used in government, military, education, and enterprise sectors. Its use is also growing in other Asian markets. The potential user population is significant.
• Attack vector: The only requirement is that a user opens a malicious file. Phishing is the most likely delivery mechanism, which lowers the barrier to entry for a wide range of threat actors.
• Lateral movement: Once a workstation is compromised, the attacker gains a foothold inside the network perimeter and can use standard internal reconnaissance and credential-theft techniques to expand access. In a government or enterprise context, this could facilitate espionage objectives.
• Supply chain / trusted document exchange: Because Hancom's HWP file format is the de facto standard for official documents in South Korea, malicious HWP files can be disguised as legitimate government or business correspondence, increasing the likelihood of user engagement.

Exploitation likelihood: The EPSS score of 0.01100 (62.6th percentile) suggests a moderate probability of exploitation in the wild. The CISA KEV database does not currently list this CVE, and there are no public exploits or PoCs. However, the vulnerability class (heap overflow in a widely deployed document parser), combined with the lack of a patch, makes this a high-priority target for nation-state actors and sophisticated cybercriminal groups that target South Korean entities.

Detection Guidance

The following detection rules are provided to help SOC teams identify attempts to deliver or exploit this vulnerability. Since no specific network signature or malformed file pattern is publicly known, these rules focus on (1) network-level detection of suspicious document file transfers, (2) host-based detection of abnormal Hancom Office process behavior, and (3) file-based detection of known malicious patterns.

Sigma Rule

title: Hancom Office HwordApp.dll Heap Overflow Exploitation Attempt
id: 3c4cd98e-7dc1-4a9f-8d4f-47b6b8e9a123
status: experimental
description: Detects suspicious Hancom Office process activity potentially related to CVE-2021-21958 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21958
author: Valtersit Threat Intelligence
date: 2024/01/15
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\Hword.exe'
            - '\HwordApp.dll'
        CommandLine|contains:
            - ' -embedding'
            - ' /automation'
    condition: selection and not filter
    filter:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\svchost.exe'
level: medium
tags:
    - attack.t1203
    - cve.2021-21958

YARA Rule

rule CVE_2021_21958_Hancom_Hword_Malicious_File
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects suspicious document files crafted to exploit Hancom Office heap overflow CVE-2021-21958"
        date = "2024-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-21958"
        cve = "CVE-2021-21958"
        severity = "high"

    strings:
        // Hancom's HWP format identifies itself with these markers
        $hwp_magic = "HWP Document File"
        $hwp_ole = { D0 CF 11 E0 A1 B1 1A E1 } // OLE2 compound file magic

        // Patterns commonly seen in malformed files attempting heap overflows:
        // Large record size fields (suspicious but not definitive)
        $large_size_1 = { FF FF FF 7F }
        $large_size_2 = { 00 00 00 80 }

        // Shellcode or script tags often embedded
        $js_embed = "javascript:"
        $vba_embed = "VBA"

    condition:
        uint16(0) == 0x5A44  // "DZ" - not a standard HWP magic
        and (($hwp_magic in (0..filesize)) or ($hwp_ole in (0..filesize)))
        and (#large_size_1 > 5 or #large_size_2 > 5)
        and ($js_embed or $vba_embed)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2021-21958 - Potential Malicious Hancom Document Download";
    flow:established,to_client;
    file.data; content:"HWP Document File"; nocase;
    file.magic;"Composite Document File";
    classtype:attempted-user;
    reference:cve,2021-21958;
    sid:90000124; rev:1;)

Elastic Detection

/* Elastic EQL rule to detect Hancom Hword.exe spawning suspicious child processes or writing unusual files */
sequence with maxspan=1h
  [process where event.action == "start" and process.name == "Hword.exe"]
  [file where process.name == "Hword.exe" and (
    file.extension == "exe" or
    file.extension == "dll" or
    file.extension == "scr" or
    file.extension == "bat"
  )]

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security
| search EventCode=4688 AND (New_Process_Name="*\\Hword.exe" OR New_Process_Name="*\\HwordApp.dll")
| eval suspicious = if(match(CommandLine, "(?i)(embedding|automation|suspicious|malformed)"), 1, 0)
| stats count by New_Process_Name, CommandLine, Creator_Process_Name, suspicious
| where suspicious=1

Wazuh OSSEC Rule

<group name="hancom,">
    <rule id="100231" level="12">
        <if_sid>100230</if_sid>
        <match>Hword.exe</match>
        <description>Hancom Office Hword.exe spawned a suspicious child process - potential CVE-2021-21958 exploitation.</description>
        <group>cve_2021_21958,</group>
        <mitre>
            <id>T1203</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Status: Patch confidence is 0/4 — no patch evidence from any tracked source. The vendor (Hancom) has not released a security fix for this vulnerability. As of the date of this report, no patch is available.

1) Immediate Mitigations (Compensating Controls)

• Restrict document file delivery: Immediately block or quarantine email attachments with extensions commonly associated with Hancom Office (e.g., .hwp, .hwt, .hwpx) at the email gateway if your organization does not strictly require these file types for business operations.
• Use application sandboxing: If feasible, run Hancom Office within a sandboxed or virtualized environment (e.g., Windows Sandbox, AppContainer, or a separate non-privileged VM) to contain the impact of a successful exploit.
• Apply Group Policy restrictions: Use software restriction policies or AppLocker to prevent Hword.exe from spawning child processes (e.g., blocking execution of cmd.exe, powershell.exe, wscript.exe, or rundll32.exe from within the Hword.doc process path).
• Deploy host-based exploit protection: Enable exploit mitigation features such as EMET (if still supported), Windows Defender Exploit Guard (including ASLR, DEP, CFG — Control Flow Guard), and Heap Metadata Protection in third-party endpoint security products.
• Raise user awareness: Educate users, especially in finance, HR, and executive functions, about phishing emails containing Hancom document attachments. Emphasize that they should not open unexpected .hwp or similar files.
• Monitor file downloads: Block or warn on downloads of Hancom document files from unfamiliar web domains or URLs.

2) Patch / Upgrade Steps

• Vendor patch: Monitor the Hancom security advisory page and update to the latest version of Hancom Office once a patched version is released. As of this report, no patch is available.
• Product update notifications: Subscribe to Hancom's security bulletin notifications to receive prompt alerts when a fix is published.
• Interim downgrade: If alternative versions of Hancom Office (e.g., older versions) are less likely to be targeted and offer independent mitigations, consider evaluating them — but note that older versions are typically less secure in general.

3) Long-Term Hardening

• Network segmentation: Segment high-value assets (e.g., financial systems, HR databases, R&D repositories) from end-user workstations so that even if a workstation is compromised, lateral movement to critical systems is restricted.
• Zero Trust architecture: Implement a Zero Trust network access model where all internal traffic is authenticated, authorized, and encrypted. This limits the blast radius of a workstation compromise.
• Endpoint Detection and Response (EDR): Deploy a robust EDR solution with behavioral analysis capabilities. Enable detection rules for memory corruption, abnormal process tree creation, and injection into or from Hancom Office processes.
• Application allowlisting: Consider implementing an allowlist approach for document-processing applications, restricting the ability to launch additional executables.
• Vulnerability management cadence: Add Hancom Office to your vulnerability scanning scope. Since this is an unpatched vulnerability, establish a manual monitoring process to check for updates.
• Strict inbound email policy: Use advanced email security solutions that perform dynamic malware analysis (sandboxing) on attachments before delivery.
• Regular reviews: Re-evaluate the necessity of Hancom Office in your environment. If alternatives (e.g., MS Office with Hancom compatibility add-ons) are acceptable for business processes, consider them to reduce the attack surface.

References

1. NVD Entry: NVD - CVE-2021-21958 — Official NVD description and severity scoring (CVSS 7.8).
2. Hancom Security Advisories (monitor for future updates): Hancom Security Center — Vendor security center, no advisory for this CVE yet.
3. CISA Known Exploited Vulnerabilities (KEV) Catalog: CISA KEV — This CVE is not listed as of the report date.
4. EPSS Data (FIRST.org): FIRST EPSS — EPSS score 0.01100 (62.6th percentile).
5. Exploit Database (ExploitDB): Exploit-DB — No public PoC or exploit module found for this CVE as of this report.

Threat Actor Campaigns / In-the-Wild Evidence: No known active threat actor campaigns have been publicly linked to CVE-2021-21958 at the time of this report. However, given the history of Hancom Office being a prime target for both nation-state espionage groups and cybercriminal operators in the Korean peninsula (e.g., Kimsuky, Lazarus Group have previously used HWP file exploits), this CVE should be treated as a high-risk, high-priority unpatched vulnerability. The absence of public exploits does not indicate that weaponized exploit code is not already circulating in closed or private exploit markets.