Unpatched Internet Explorer Zero-day Vulnerability Lets Attackers Hack Windows PC & Steal Files

Security researcher disclose the new Internet Explorer zero-day vulnerability along with Proof-of-concept allows hackers to steal files from Windows computer.

Internet Explorer is one of the widely used web browsers developed by Microsoft and included in the Microsoft Windows line of operating systems, starting in 1995.

An XML External Entity Injection vulnerability affected the current version of Microsoft Internet Explorer v11 let remote attackers compromise the windows to exfiltrate Local files and conduct remote reconnaissance on locally installed Program version data.

Based on the Browser Market Share report, Internet Explorer is a 2nd largest web browser that is used by millions of users around the world including within a corporate networks.

How Does This Internet Explorer Zero-day Works

Since the Internet Explorer vulnerable to XML External Entity Injection flaw, the targeted system can be exploited by an attacker if any user opens a specially crafted .MHT file locally.

Let’s assume a victims open the malicious .MHT” file locally via Internet Explorer, Afterwards, if the user performs an interaction like duplicate tab “Ctrl+K” and other interactions like right click “Print Preview” or “Print” commands on the web-page leads to triggering this vulnerability and exploit the system.

In order to perform this attack without user interaction, a simple call to the window.print() Javascript function should do the trick. Let’s have a look at the Proof-of-concept video demonstration.

“According to John Page (aka hyp3rlinx) who reported this Internet Explorer Zero-day flaw said, when instantiating ActiveX Objects like “Microsoft.XMLHTTP” users will get a security warning bar in IE and be prompted to activate blocked content. However, when opening a specially crafted .MHT file using malicious markup tags the user will get no such active content or security bar warnings”

How to Exploit this Vulnerability

POC to exfil Windows “system.ini” file and also Edit attacker server IP in the script to suit your needs.

1) Use This script to create the “datatears.xml” XML and XXE embedded “msie-xxe-0day.mht” MHT file.

2) python -m SimpleHTTPServer

3) Place the generated “datatears.xml” in Python server web-root.

4) Open the generated “msie-xxe-0day.mht” file, watch your files be exfiltrated.

Researcher was reported this vulnerability on March 27, 2019, and he got the acknowledgment the same day from Microsoft.

But Microsoft said, We determined that a fix for this issue will be considered in a future version of this product or service. At this time, we will not be providing ongoing updates of the status of the fix for this issue”

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated

Also Read:

APT Hackers Group Exploiting the Window OS Using New Zero day Vulnerability

Microsoft Released Security updates & Fixed 74 Vulnerabilities Including 2 Latest Zero-day

Hackers Exploit Cisco Zero Day Vulnerability in Wild Resulting in DoS Condition

Hackers Started Exploiting the Unpatched Windows Task Scheduler Zero Day Flaw using Malware