switch from native launcher to jar launcher

Considering the amount of URI handlers Windows ships with, it seems very likely that others are vulnerable tooĬode execution is triggered by a malicious website which performs a Javascript redirect to a crafted `ms-officecmd:` URI (a scheme used by the Microsoft Office UWP app to launch other Office desktop applications). The patch they came up with after 5 months failed to properly address the underlying argument injection (which is currently also still present on Windows 11) - Our research journey was straightforward: We decided to find a code execution vulnerability in a default Windows 10 URI handler, and succeeded within two weeks. After our appeal, the issue was classified as 'Critical, RCE', but only 10% of the bounty advertised for its classification was awarded ($5k vs $50k). Alternatively, a malicious URI could be delivered via a () - Microsoft Bug Bounty Program's (MSRC) response was poor: Initially, they misjudged and dismissed the issue entirely.

We discovered a drive-by code execution vulnerability on Windows 10 via IE11/Edge Legacy and MS Teams, triggered by an argument injection in the Windows 10/11 default handler for `ms-officecmd:` URIs - Exploitation through other browsers requires the victim to accept an inconspicuous confirmation dialog.

Switch from native launcher to jar launcher