# Exploit Title:  Microsoft Windows 'Internet Settings' Misconfiguration Security Feature Bypass Vulnerability

# Google Dork: N/A

# Date: September, 17 2019

# Exploit Author:  Eduardo Braun Prado

# Vendor Homepage: http://www.microsoft.com/

# Software Link: http://www.microsoft.com/

# Version: Windows 7 SP1, 8.0, 8.1 x86 and x64 with full patches up to July 2019

# Tested on: Windows 7 SP1, 8.0, 8.1 x86 and x64 with full patches up to July 2019

# CVE : n/a


Details: A recent setting has been introduced to the 'Internet settings' of Windows that applies to MS IE and several programs that utilize its libraries

which can enable or disable the VBScript engine on a per-zone basis. On the Registry:


HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\X


value: 140C

type: DWORD

data: 0  (0= allow | 1= prompt | 3 = disallow)

where 'X' is an integer between 0 and 4, and they are related to security zones. It´s permitted by default on 'Local Intranet', 'Trusted Sites' and 'Local Machine' and disabled by default on 'Internet' and 'Restricted Sites'


The misconfiguration issue happens because on the affected Windows versions, the setting was defined to '0' (Allow) when it should be '3' (disallow).

The impact is permitting web pages to invoke VBScript engine on security zones that should not be allowed.


To make sure this setting is on its default on all supported OSes, one can run the following commands (from eg. 'Run' menu or CMD prompt)

%comspec% /k reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" /v 140C /t REG_DWORD /d 3 /f

%comspec% /k reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" /v 140C /t REG_DWORD /d 3 /f

%comspec% /k reg add "HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" /v 140C /t REG_DWORD /d 3 /f


Vendor was contacted on July 11, 2019.

Vendor replied on July 15, 2019 saying the issue was successfully reproduced and would be fixed on August, 2019 monthly patch.

Officially patched on August, 2019 (on the cumulative update for MS IE)


Warning: on Windows 7 machines, it might be necessary to run the above commands because the setting is also defined on HKEY_CURRENT_USER registry key which will take over HKEY_LOCAL_MACHINE.