Pierluigi Paganini December 28, 2018

The security researcher Bruno Keith from the Phoenhex group published a PoC code for a remote code execution flaw in Microsoft Edge browser (CVE-2018-8629).

The vulnerability affects the JavaScript engine Chakra implemented in the Edge web browser, an attacker could exploit it to execute arbitrary code on the target machine with the same privileges as the logged user.

“A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.” reads the security advisory published by Microsoft.

Microsoft rated the flaw as critical severity on most operating systems, only Windows server editions 2019 and 2016 it was rated as ‘moderate’ severity.

The PoC code published could trigger an out-of-bounds (OOB) memory read leak, experts warn that threat actors could modify the code to carry out other malicious activities.

“Chakra failed to insert value compensation which cause the headSegmentsym to be reloaded // but not the headSegmentLength sym, we therefore accessed the new buffer with the wrong length checked” wrote the expert.

“In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge and then convince a user to view the website. continues the advisory published by Microsoft.

“The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.”

“In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge and then convince a user to view the website,” Continues the advisory.

Adversaries could also use a different approach to infect user computers: placing the exploit code in a location the user is likely to access, such as a website or advertisements, can do the trick just as good, the company added.

Even if Microsoft has addressed the flaw with December security updates, unpatched systems are exposed to attacks.

Pierluigi Paganini

(SecurityAffairs – Microsoft Edge , hacking)

[adrotate banner=”5″] [adrotate banner=”13″]