The Network Reconnaissance Risk Inside Attached Templates
Enterprise environments utilize corporate templates (`.dotx` or `.dotm` files) to standardize letterheads, legal boilerplate, and styling across departments. When an employee creates a document, Word records the full file system or network path to that template in `docProps/app.xml` and `word/_rels/settings.xml.rels`.
If the template was loaded from a corporate network share, the file embeds a Universal Naming Convention (UNC) path: `\\fileserver.na.internal.corp\templates\legal\StandardNDA_2026.dotx`.
When this document is emailed to an external party or uploaded publicly, threat actors gain valuable internal reconnaissance intelligence: internal Active Directory domain names, file server hostnames, department nomenclature, and organizational folder trees.
Office template tags routinely leak internal Active Directory domain names and file server paths to external recipients.
Template Injection Attacks and Remote SMB Relaying
Beyond passive information disclosure, remote template references can be weaponized. In "template injection" attacks, an adversary modifies `word/_rels/settings.xml.rels` to point the `Target` attribute to an attacker-controlled SMB server (`\\evil-smb.attacker.com\template.dotx`).
When an unsuspecting victim opens the document, Microsoft Word automatically attempts to establish an SMB connection to retrieve the template, transmitting the victim’s NTLMv2 password hash to the attacker. Scrubbing template references eliminates both passive reconnaissance leaks and active connection triggers.
Neutralizing Template Paths with OverlayCheck
OverlayCheck parses the OpenXML relationship trees, detects external and local template references, and resets the `<Template>` tag to the generic `Normal.dotm` baseline, neutralizing internal network reconnaissance risks.
Template Path Handling: Standard Office vs. Sanitized Document
Evaluating template leakage prevention and SMB relay attack mitigation.
| Feature / Dimension | OverlayCheck (Client-Side) | Unscrubbed Office Document | Third-Party Online Sanitizers |
|---|---|---|---|
| UNC Network Path Exposure | Completely Neutralized (Reset to Normal.dotm) | Fully Exposed (Leaks internal servers) | Varies (Often preserves template tags) |
| Remote SMB Connection Risk | Eliminated (External references purged) | Active (May trigger automatic network calls) | Eliminated if server parses relationships |
Command-Line Automation & CLI Workflows
For security engineers and forensic examiners automating pipelines or conducting terminal audits, the equivalent low-level commands can be executed natively:
unzip -p document.docx | grep -iE "\\\\[a-zA-Z0-9.-]+\\"Frequently Asked Technical Questions
Q1:Does resetting the template path break the document styling?
No. Word embeds all active font, paragraph, and style definitions directly into word/styles.xml within the document itself, so layout is fully preserved.
Q2:Can template paths leak on macOS or Linux?
Yes. macOS versions of Word record absolute POSIX paths (e.g., /Users/username/Library/Group Containers/...) which leak local user account names.