Microsoft Internet Explorer 11 - VBScript Execution Policy Bypass in MSHTML Exploit

🗓️ 19 Mar 2019 00:00:00Reported by Google Security ResearchType

zdt🔗 0day.today👁 64 Views

Microsoft Internet Explorer 11 VBScript Execution Policy Bypass in MSHTML Exploi

Reporter	Title	Published	Views	Family All 26
GithubExploit	Exploit for Out-of-bounds Write in Microsoft	18 Dec 202022:28	–	githubexploit
GithubExploit	Exploit for Out-of-bounds Write in Microsoft	23 May 201910:28	–	githubexploit
0day.today	Microsoft Internet Explorer Windows 10 1809 17763.316 - Scripting Engine Memory Corruption Exploit	24 May 201900:00	–	zdt
BDU FSTEC	The vulnerability of the VBScript script handler in Internet Explorer allows attackers to disclose protected information.	27 Mar 201900:00	–	bdu_fstec
Circl	CVE-2019-0768	19 Mar 201900:00	–	circl
CNVD	Microsoft Internet Explorer Security Bypass Vulnerability (CNVD-2019-07240)	13 Mar 201900:00	–	cnvd
Check Point Advisories	Microsoft Internet Explorer Security Feature Bypass (CVE-2019-0768)	12 Mar 201900:00	–	checkpoint_advisories
CVE	CVE-2019-0768	9 Apr 201901:37	–	cve
Cvelist	CVE-2019-0768	9 Apr 201901:37	–	cvelist
exploitpack	Microsoft Internet Explorer Windows 10 1809 17763.316 - Scripting Engine Memory Corruption	24 May 201900:00	–	exploitpack

<!--
Windows: Windows: IE11 VBScript execution policy bypass in MSHTML
Platform: Windows 10 1809 (not tested earlier)
Class: Security Feature Bypass

Summary:
MSHTML only checks for the CLSID associated with VBScript when blocking in the Internet Zone, but doesn’t check other VBScript CLSIDs which allow a web page to bypass the security zone policy.

Description:
According to https://blogs.windows.com/msedgedev/2017/07/07/update-disabling-vbscript-internet-explorer-11/, Starting from Windows 10 Fall Creators Update, VBScript execution in IE 11 should be disabled for websites in the Internet Zone and the Restricted Sites Zone by default.

The check for the VBScript security zone policy is done in MSHTML!AllowVBScript which is only called from MSHTML!CScriptCollection::GetHolderCLSID if the script language CLSID matches {b54f3741-5b07-11cf-a4b0-00aa004a55e8}. However, IE still supports the old VBScript.Encode language which has a slightly different CLSID of {b54f3743-5b07-11cf-a4b0-00aa004a55e8}. Therefore to bypass the VBScript zone security policy it’s possible to just change the language attribute in the HTML from “VBScript” to “VBScript.Encode”. To add insult to injury you don’t even need to encode the VBScript as if the engine detects the script is not encoded it tries to parse it as unencoded script.

Proof of Concept:

I’ve provided a PoC as a HTML file with a meta tag to force IE5 compatibility. Just host on an HTTP server.

1) Browse IE11 to the PoC on the web server.

Expected Result:
No VBScript is executed.

Observed Result:
VBScript is executed and a message box is displayed.
-->

<html>
<head>
<meta http-equiv="x-ua-compatible" content="IE=5">
</head>
<body>
<script language="VBScript.Encode">
MsgBox "Hello"
</script>
</body>
</html>

19 Mar 2019 00:00Current

0.3Low risk

Vulners AI Score0.3

CVSS 24.3

CVSS 34.3

EPSS0.85006