“A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.” reads the security advisory published by Microsoft.
A Microsoft classificou a falha com severidade crítica na maioria dos sistemas operativos, apenas as edições 2019 e 2016 do Windows Server foram classificadas com severidade “moderada”.
O PoC publicado pode provocar um leak de memória out-of-bounds (OOB). Os investigadores alertam que os agentes de ameaça podem modificar o código para realizar outras atividades maliciosas.
“Chakra failed to insert value compensation which cause the headSegmentsym to be reloaded // but not the headSegmentLength sym, we therefore accessed the new buffer with the wrong length checked” wrote the expert.
I published the PoC for CVE-2018-8629: a JIT bug in Chakra fixed in the latest security updates. It resulted in an (almost) unbounded relative R/W https://t.co/47TIYtVB8f
— Bruno @ C3 (@bkth_) December 27, 2018
“In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge and then convince a user to view the website. continues the advisory published by Microsoft.
“The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.”
“In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge and then convince a user to view the website,” Continues the advisory.
Os adversários também podem usar uma abordagem diferente para infetar computadores das vítimas: colocar o código num local onde a vítima possa aceder facilmente, como um website ou até anúncios enganosos.
Mesmo que a Microsoft tenha resolvido a falha com as atualizações de segurança de dezembro, os sistemas sem patches estão expostos a ataques.
Pedro Tavares is a professional in the field of information security, working as an Ethical Hacker, Malware Analyst, Cybersecurity Analyst and also a Security Evangelist. He is also a founding member and Pentester at CSIRT.UBI and founder of the security computer blog seguranca-informatica.pt.
In recent years he has invested in the field of information security, exploring and analyzing a wide range of topics, such as pentesting (Kali Linux), malware, hacking, cybersecurity, IoT and security in computer networks. He is also Freelance Writer.
Read more here.