Zero-day vulnerability in Windows
Memory corruption
CVE-2018-8174
Vulnerability exploitation was detected by Qihoo 360. The company uncovered a zero-day vulnerability in IE, dubbed ‘double play’, that was triggered by weaponized MS Office documents. The experts have been observing an APT group targeting a limited number of users exploiting the zero-day flaw.
Hackers can use the ‘double play’ flaw to implant a backdoor Trojan and take full control over the vulnerable machine.
The APT group was delivering an Office document with a malicious web page embedded, once the user opens the document, the exploit code and malicious payloads are downloaded and executed from a remote server. The later phase of this attack leverages a public UAC bypass technique and uses file steganography and memory reflection loading to avoid traffic monitoring and achieve loading with no files. This ‘double play’ vulnerability may affect the latest versions of Internet Explorer and applications that are with IE kernel.
For now most of the victims are located in Asia.
In May 2018 the vulnerability was added into the RIG exploit kit, after the PoC code became publicly available.
RIG exploit kit
Vulnerability details
Advisory: SB2018042106 - Remote code execution in Microsoft VBScript engine
Vulnerable component: Windows
CVE-ID: CVE-2018-8174
CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C
CWE-ID: CWE-119 - Memory corruption
Description:
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the VBScript engine. A remote attacker can trick the victim into visiting a specially crafted website or open a malicious Office file and execute arbitrary code on the target system.
Note: the vulnerability is being actively exploited in the wild against victims in Asia region. The vulnerability is dubbed "double play".