Reading Time: 2 minutes

Um investigador do grupo Phoenhex publicou uma exploit como PoC para um RCE no navegador Microsoft Edge (CVE-2018-8629).

A vulnerabilidade (CVE-2018-8629) afeta o recurso JavaScript Chakra implementado no navegador Microsoft Edge. Um invasor pode explorá-lo para executar código arbitrário (RCE) na máquina de destino com os mesmos privilégios no contexto do utilizador registado — o PoC pode ser acedido aqui.

“A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.” reads the security advisory published by Microsoft.

 

A Microsoft classificou a falha com severidade crítica na maioria dos sistemas operativos, apenas as edições 2019 e 2016 do Windows Server foram classificadas com severidade “moderada”.

O PoC publicado pode provocar um leak de memória out-of-bounds (OOB). Os investigadores alertam que os agentes de ameaça podem modificar o código para realizar outras atividades maliciosas.

“Chakra failed to insert value compensation which cause the headSegmentsym to be reloaded // but not the headSegmentLength sym, we therefore accessed the new buffer with the wrong length checked” wrote the expert.

 

“In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge and then convince a user to view the website. continues the advisory published by Microsoft.

“The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.”

“In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge and then convince a user to view the website,” Continues the advisory.

 

Os adversários também podem usar uma abordagem diferente para infetar computadores das vítimas: colocar o código num local onde a vítima possa aceder facilmente, como um website ou até anúncios enganosos.

Mesmo que a Microsoft tenha resolvido a falha com as atualizações de segurança de dezembro, os sistemas sem patches estão expostos a ataques.