Traps Prevents In-The-Wild VBScript Zero-Day Exploit in Internet Explorer
Summary: Trend Micro reported on August 15 an in-the-wild exploit of a VBScript Engine vulnerability in Internet Explorer, CVE-2018-8373, affecting endpoints running current Internet Explorer and Windows versions without the relevant patches. The exploit was served from hxxp://windows-updater[.]net and linked by Qihoo 360 to the DarkHotel APT campaign, which also exploited CVE-2018-8174 earlier in the year; the chain uses a UAF in vbscript.dll to reach VirtualProtect, then downloads and loads a payload dubbed zlib1.dll, with a UAC bypass via mmc.exe on x86 systems.
What you should know: The actor behind this exploit, DarkHotel, had already exploited a different VBScript vulnerability earlier the same year, and the secondary payload was never retrieved for analysis - so the full scope of what this campaign delivers to infected machines remains unknown.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-8174CVE-2018-8373
- Related
- On VBScript Cyber Risks ·CVE-2018-8373: Microsoft Scripting Engine Memory Corruption Vulnerability Known Exploited Vulnerabilities · Mar 25, 2022CVE-2018-8174: Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · Feb 15, 2022