Zero-Day in Internet Explorer [POC with Video]
The security researcher published Internet Explorer Zero-Day Vulnerability with Proof of Concept (POC) after Microsoft ignore to fix.
Proof of concept details published as cyber attack through malicious MHT file a kind of Web page archive file format. Once victim open the MHT file is able to steal local files of users. The vulnerability affects Windows 7, Windows 10 and Server 2012 R2.
The user needs to click on a file, sent by a cyber attacker, the victim will be received through email or online messaging service. The malicious file could be disabled Internet Explorer security system.
The vulnerability found by security researcher John Page, he has published the details,
Internet Explorer is vulnerable to XML External Entity attack if a user opens a specially crafted .MHT file locally.
- It can allow remote attackers to potentially exfiltrate Local files and conduct remote reconnaissance on locally installed Program version information. Example, a request for “c:\Python27\NEWS.txt” can return version information for that program.
- Upon opening the malicious “.MHT” file locally it should launch Internet Explorer.
- Afterwards, user interactions like duplicate tab “Ctrl+K”and other interactions like right click “Print Preview” or “Print” commands on the web-page may also trigger the XXE vulnerability.
- However, a simple call to the window.print() Javascript function should do the trick without requiring any user interaction with the webpage.
Check the full POC script here
Importantly, if files are downloaded from the web in a compressed archive and opened using certain archive utilities MOTW may not work as advertised.
Typically, when instantiating ActiveX Objects like “Microsoft.XMLHTTP” users will get a security warning bar in IE and be prompted to activate blocked content. However, when opening a specially crafted .MHT file using malicious <xml> markup tags the user will get no such active content or security bar warnings.
Tested successfully in latest Internet Explorer Browser v11 with latest security patches on Win7/10 and Server 2012 R2.
Video POC
Microsoft Reporting Timeline
John has submitted the vulnerability to Microsoft (MSRC) on 27 March 2019, MSRC opens the case on 28 March, but on 10th April, they declined with a message.
"We determined that a fix for this issue will be considered in a future version of this product or service. At this time, we will not be providing ongoing updates of the status of the fix for this issue, and we have closed this case."
After that researcher publicly discloses the vulnerability.
Companies must be serious about the submitted vulnerability by security researchers, the above bug is able to exploit the user’s computers with malicious code through MHT files.
