CVE-2016-3351
Microsoft Internet Explorer and Edge Information Disclosure Vulnerability
Description
CVE-2016-3351 is an information disclosure vulnerability in Microsoft Internet Explorer and Edge that allows attackers to detect the presence of specific files on a user's computer. The vulnerability arises from the way certain functions in these browsers handle objects in memory, enabling file existence probing through crafted web content. Attackers use this capability to fingerprint target systems, identify security tools, and determine whether to deploy exploit payloads. CVE-2016-3351 has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog with a confirmed ransomware association, and its EPSS percentile of 97.3% indicates very high exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | internet explorer | 9; 10; 11 |
| microsoft | edge | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- http://www.securityfocus.com/bid/92788(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1036788(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1036789(Broken Link, Third Party Advisory, VDB Entry)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-104(Patch, Vendor Advisory)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-105(Patch, Vendor Advisory)
- https://www.brokenbrowser.com/detecting-apps-mimetype-malware/(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3351(US Government Resource)
Weakness Type
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-200 describes situations where a product reveals sensitive information to unauthorized parties. In CVE-2016-3351, Internet Explorer and Edge improperly handle objects in memory during certain operations, creating an information leak that allows remote attackers to determine whether specific files exist on the victim's local file system through a crafted web page.
Learn more: CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
Impact Analysis
CVE-2016-3351 impacts confidentiality by enabling remote attackers to detect files on the target system through Internet Explorer or Edge. The vulnerability is exploitable remotely through crafted web content, requiring user interaction (visiting a malicious page) but no authentication. While the direct impact is limited to information disclosure, the reconnaissance value is significant in attack chains. The EPSS percentile of 97.3% reflects very high exploitation activity. CISA has confirmed a ransomware association with this vulnerability, indicating it has been used as part of multi-stage attacks where file detection served as a preliminary step before ransomware deployment. The vulnerability was notably used by the AdGholas and GooNky threat groups in large-scale malvertising campaigns to filter targets and evade security research environments.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2016-3351 and added it to the Known Exploited Vulnerabilities catalog with a confirmed ransomware association and a remediation deadline of June 14, 2022. The EPSS percentile of 97.3% indicates very high exploitation probability. This vulnerability was extensively used by the AdGholas and GooNky malvertising groups to detect security analysis tools and virtual machine environments on target systems before delivering exploit payloads. The ransomware association confirms its role in attack chains that culminated in ransomware deployment, making it a critical reconnaissance component in financially motivated cybercrime operations.
Remediation
- Apply Microsoft security updates as directed by the vendor. This is the required remediation action per CISA's KEV catalog entry for CVE-2016-3351.
- Migrate away from Internet Explorer to a modern browser. While Edge was also affected, current versions of Microsoft Edge (Chromium-based) are not vulnerable to this legacy issue.
- Deploy ad-blocking and web content filtering solutions to reduce exposure to malvertising campaigns that commonly leveraged this vulnerability.
- Implement network-level protections including intrusion prevention systems (IPS) with signatures for known exploit kit patterns.
- Monitor for indicators of compromise associated with the AdGholas and GooNky malvertising campaigns, and review browser security logs for signs of file system probing activity.
Technical Details
CVE-2016-3351 exploits a flaw in how Internet Explorer and Edge handle objects in memory during certain internal operations. The vulnerability falls under CWE-200 (Exposure of Sensitive Information), where the browsers fail to properly isolate JavaScript operations from the local file system. Attackers can use MIME type handling behavior and certain browser APIs to determine whether specific files exist on the victim's disk by observing differences in the browser's response when referencing existing versus non-existing file paths. The attack vector is network-based, requiring the victim to visit a malicious or compromised web page, but the exploitation complexity is low. This vulnerability was particularly notable for being a zero-day exploited by sophisticated malvertising groups for over a year before the patch was released, demonstrating the high value of file detection capabilities in commercial exploit kit operations.
Frequently Asked Questions
Is CVE-2016-3351 being actively exploited?
Yes, CVE-2016-3351 has been actively exploited in malvertising campaigns. CISA has confirmed active exploitation and added it to the KEV catalog with a ransomware association. The EPSS percentile of 97.3% reflects very high exploitation probability, driven by its use in the AdGholas and GooNky campaigns.
What products are affected by CVE-2016-3351?
CVE-2016-3351 affects Microsoft Internet Explorer and Microsoft Edge (legacy EdgeHTML-based versions). Current Chromium-based Microsoft Edge is not affected. Multiple versions of these browsers across Windows platforms are vulnerable.
How do I fix CVE-2016-3351?
Apply the Microsoft security update for CVE-2016-3351. Migrate from Internet Explorer and legacy Edge to modern Chromium-based browsers. See the Remediation section for detailed steps.
How severe is CVE-2016-3351?
CVE-2016-3351 is an information disclosure vulnerability with an EPSS percentile of 97.3% and a confirmed ransomware association. While it does not directly enable code execution, its role as a reconnaissance tool in malvertising campaigns that led to ransomware deployment makes it a significant threat in multi-stage attack chains.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.