exploit the possibilities

Microsoft Windows Internet Settings Security Feature Bypass

Microsoft Windows Internet Settings Security Feature Bypass
Posted Sep 17, 2019
Authored by Eduardo Braun Prado

Microsoft Windows suffers from an Internet Settings misconfiguration security feature bypass vulnerability. Versions affected include Windows 7 SP1, 8.0, 8.1 x86 and x64 with full patches up to July 2019.

tags | exploit, x86, bypass
systems | windows, 7
MD5 | ff0c1e4363db410575808afd701e6662

Microsoft Windows Internet Settings Security Feature Bypass

Change Mirror Download
# Exploit Title:  Microsoft Windows 'Internet Settings' Misconfiguration Security Feature Bypass Vulnerability

# Google Dork: N/A

# Date: September, 17 2019

# Exploit Author: Eduardo Braun Prado

# Vendor Homepage: http://www.microsoft.com/

# Software Link: http://www.microsoft.com/

# Version: Windows 7 SP1, 8.0, 8.1 x86 and x64 with full patches up to July 2019

# Tested on: Windows 7 SP1, 8.0, 8.1 x86 and x64 with full patches up to July 2019

# CVE : n/a


Details: A recent setting has been introduced to the 'Internet settings' of Windows that applies to MS IE and several programs that utilize its libraries

which can enable or disable the VBScript engine on a per-zone basis. On the Registry:


HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\X


value: 140C

type: DWORD

data: 0 (0= allow | 1= prompt | 3 = disallow)

where 'X' is an integer between 0 and 4, and they are related to security zones. It´s permitted by default on 'Local Intranet', 'Trusted Sites' and 'Local Machine' and disabled by default on 'Internet' and 'Restricted Sites'


The misconfiguration issue happens because on the affected Windows versions, the setting was defined to '0' (Allow) when it should be '3' (disallow).

The impact is permitting web pages to invoke VBScript engine on security zones that should not be allowed.


To make sure this setting is on its default on all supported OSes, one can run the following commands (from eg. 'Run' menu or CMD prompt)

%comspec% /k reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" /v 140C /t REG_DWORD /d 3 /f

%comspec% /k reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" /v 140C /t REG_DWORD /d 3 /f

%comspec% /k reg add "HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" /v 140C /t REG_DWORD /d 3 /f


Vendor was contacted on July 11, 2019.

Vendor replied on July 15, 2019 saying the issue was successfully reproduced and would be fixed on August, 2019 monthly patch.

Officially patched on August, 2019 (on the cumulative update for MS IE)


Warning: on Windows 7 machines, it might be necessary to run the above commands because the setting is also defined on HKEY_CURRENT_USER registry key which will take over HKEY_LOCAL_MACHINE.

Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    0 Files
  • 5
    Aug 5th
    0 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    0 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close