Saturday, December 2, 2023

Unpatched Internet Explorer Zero-day Vulnerability Lets Attackers Hack Windows PC & Steal Files

Security researcher disclose the new Internet Explorer zero-day vulnerability along with Proof-of-concept allows hackers to steal files from Windows computer.

Internet Explorer is one of the widely used web browsers developed by Microsoft and included in the Microsoft Windows line of operating systems, starting in 1995.

An XML External Entity Injection vulnerability affected the current version of Microsoft Internet Explorer v11 let remote attackers compromise the windows to exfiltrate Local files and conduct remote reconnaissance on locally installed Program version data.

Based on the Browser Market Share report, Internet Explorer is a 2nd largest web browser that is used by millions of users around the world including within a corporate networks.

How Does This Internet Explorer Zero-day Works

Since the Internet Explorer vulnerable to XML External Entity Injection flaw, the targeted system can be exploited by an attacker if any user opens a specially crafted .MHT file locally.

Let’s assume a victims open the malicious .MHT” file locally via Internet Explorer, Afterwards, if the user performs an interaction like duplicate tab “Ctrl+K” and other interactions like right click “Print Preview” or “Print” commands on the web-page leads to triggering this vulnerability and exploit the system.

In order to perform this attack without user interaction, a simple call to the window.print() Javascript function should do the trick. Let’s have a look at the Proof-of-concept video demonstration.

IE Zero-day Proof-of-concept

“According to John Page (aka hyp3rlinx) who reported this Internet Explorer Zero-day flaw said, when instantiating ActiveX Objects like “Microsoft.XMLHTTP” users will get a security warning bar in IE and be prompted to activate blocked content. However, when opening a specially crafted .MHT file using malicious markup tags the user will get no such active content or security bar warnings”

How to Exploit this Vulnerability

POC to exfil Windows “system.ini” file and also Edit attacker server IP in the script to suit your needs.

1) Use This script to create the “datatears.xml” XML and XXE embedded “msie-xxe-0day.mht” MHT file.

2) python -m SimpleHTTPServer

3) Place the generated “datatears.xml” in Python server web-root.

4) Open the generated “msie-xxe-0day.mht” file, watch your files be exfiltrated.

Researcher was reported this vulnerability on March 27, 2019, and he got the acknowledgment the same day from Microsoft.

But Microsoft said, We determined that a fix for this issue will be considered in a future version of this product or service. At this time, we will not be providing ongoing updates of the status of the fix for this issue”

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated

Also Read:

APT Hackers Group Exploiting the Window OS Using New Zero day Vulnerability

Microsoft Released Security updates & Fixed 74 Vulnerabilities Including 2 Latest Zero-day

Hackers Exploit Cisco Zero Day Vulnerability in Wild Resulting in DoS Condition

Hackers Started Exploiting the Unpatched Windows Task Scheduler Zero Day Flaw using Malware


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles