Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help. URL that triggers loading of hxds.dll.
Recent assessments:
wchen-r7 at September 12, 2019 6:07pm UTC reported:
Exploit Hash: 203aa9b2439cfab4ff1678a227be9a9a
CVE-2013-3893 is a use-after-free vulnerability that affects Internet Explorer versions 6/7/8/9/10/11.
It was initially found being exploited in Japan. A fix-it workaround is already available at the time
of the writing, no information on when Microsoft will release an official final to address the IE flaw.
A sample of the exploit (in the wild) can be found on VirusTotal, scrumware.org, and jsunpack.
The exploit in the wild is written to target IE8/9, Win XP and Windows 7. Under Win XP, the code is
specifically tweaked to work against languages including English, Chinese, Japanese, Korean, although
its fingerprinting code actually checks these languages: English, Chinese, French, German, Japanese,
Portuguese, Korean, and Russian. It is safe to say itβs designed to work against Windows machines in
Asia, hard to why other languages are fingerprinted but not tweaked. Either because the author was
lazy to test them, and the fingerprinting code was a lazy copy-and paste. Or, they can be exploited
successfully without any tweaks. Under Windows 7, Office 2007 is also required to engauge the target,
however the fingerprinting code also checks Office 2010, which seems rather unnecessary. The exploit
will attempt again and again until either the browser crashes, or indefinitely. After exploitation,
the exploit will set a cookie on the victim machine as a way to avoid hitting the same target again.
The vulnerability is due to how the mshtml!CDoc::SetMouseCapture function handles a reference during
an event. An attacker first can setup two elements, where the second is the child of the first, and
then setup a onlosecapture event handler for the parent element. The onlosecapture event seems to
require two setCapture() calls to trigger, one for the parent element, one for the child. When the
setCapture() call for the child element is called, it finally triggers the event, which allows the
attacker to cause an arbitrary memory release using document.write(), which in particular frees up
a 0x54-byte memory. The exact size of this memory may differ based on the version of IE. After the
free, an invalid reference will still be kept and pass on to more functions, eventuall this arrives
in function MSHTML!CTreeNode::GetInterface, and causes a crash (or arbitrary code execution) when
this function attempts to use this reference to call what appears to be a PrivateQueryInterface due
to the offset (0x00).
Assessed Attacker Value: 0
Assessed Attacker Value: 0Assessed Attacker Value: 0
blogs.technet.com/b/srd/archive/2013/09/17/cve-2013-3893-fix-it-workaround-available.aspx
blogs.technet.com/b/srd/archive/2013/10/08/ms13-080-addresses-two-vulnerabilities-under-limited-targeted-attacks.aspx
jsunpack.jeek.org/dec/go?report=b9a3acd552362b4a16f27eaeb460e13dba43e5b8
jvn.jp/en/jp/JVN27443259/index.html
jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-000093.html
osvdb.org/show/osvdb/97380
pastebin.com/raw.php?i=Hx1L5gu6
technet.microsoft.com/en-us/security/advisory/2887505
technet.microsoft.com/security/advisory/2887505
threatpost.com/microsoft-warns-of-new-ie-zero-day/102327
www.cvedetails.com/cve/CVE-2013-3893
www.securityfocus.com/bid/62453
www.us-cert.gov/ncas/alerts/TA13-288A
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3893
docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18665