CVE-2018-8373
Microsoft Scripting Engine Memory Corruption Vulnerability
Description
CVE-2018-8373 is a memory corruption vulnerability in the Microsoft Internet Explorer scripting engine that allows remote code execution through specially crafted VBScript content. An attacker can exploit this flaw by convincing a user to visit a malicious website or open a crafted document that triggers the VBScript engine, leading to arbitrary code execution with the privileges of the current user. This vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on March 25, 2022, and with an EPSS score of 97.3% (99.9th percentile), exploitation is near-certain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | internet explorer | 11; 10; 9 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/105037(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1041483(Broken Link, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8373(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8373(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2018-8373 is classified under CWE-119, which describes vulnerabilities where software performs operations on a memory buffer without properly restricting the read or write boundaries. The Internet Explorer VBScript engine incorrectly handles objects in memory, leading to a corruption condition that allows an attacker to execute arbitrary code.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2018-8373 allows remote attackers to execute arbitrary code on systems running Internet Explorer by exploiting a memory corruption flaw in the VBScript engine. The code executes with the privileges of the current user, and if the user has administrative rights, the attacker gains full control of the system. The vulnerability can be triggered through drive-by download attacks via malicious or compromised websites, Office documents containing embedded VBScript or browser controls, and email-based phishing campaigns directing victims to exploit pages. Internet Explorer's widespread deployment in enterprise environments and its use as an embedded browser component in many Windows applications broadens the potential attack surface. The EPSS score of 97.3% confirms near-certain exploitation.
Exploit Maturity
CVE-2018-8373 has been confirmed as actively exploited in the wild by CISA, with exploitation observed in targeted attack campaigns prior to the patch release (zero-day exploitation). The vulnerability was used in real-world attacks before Microsoft released the security update, and public exploit information is now available. With an EPSS score of 97.3% (99.9th percentile), exploitation remains near-certain for any unpatched system.
Remediation
- Apply Microsoft security updates: Install the August 2018 cumulative security update from Microsoft that addresses CVE-2018-8373.
- Disable VBScript in Internet Explorer: Configure Internet Explorer security zones to disable Active Scripting or specifically restrict VBScript execution for the Internet and Local Intranet zones.
- Migrate away from Internet Explorer: Transition to Microsoft Edge or another modern browser that does not support VBScript execution.
- Deploy endpoint protection: Ensure endpoint security solutions are updated to detect exploitation attempts targeting the VBScript engine.
- Implement network-level protections: Deploy web proxies or DNS filtering to block access to known exploit distribution sites.
Technical Details
CVE-2018-8373 is a memory corruption vulnerability in the VBScript engine (vbscript.dll) used by Microsoft Internet Explorer. The vulnerability occurs when the scripting engine improperly handles objects in memory during VBScript execution. An attacker can craft VBScript code that manipulates the engine's internal state to corrupt memory in a controlled manner, ultimately achieving arbitrary code execution. The exploit typically uses techniques such as heap spraying to place shellcode at predictable memory locations, followed by triggering the memory corruption to redirect execution flow. The vulnerability was exploited as a zero-day in targeted attacks, with the exploit delivered through malicious web pages that automatically executed VBScript when visited by Internet Explorer.
Frequently Asked Questions
Is CVE-2018-8373 being actively exploited?
Yes. CVE-2018-8373 was exploited as a zero-day before Microsoft released a patch. CISA has confirmed active exploitation, and the EPSS score of 97.3% indicates near-certain exploitation for unpatched systems.
What products are affected by CVE-2018-8373?
CVE-2018-8373 affects Microsoft Internet Explorer versions 9, 10, and 11 across all supported Windows platforms. Any application that embeds the Internet Explorer browser control (WebBrowser) may also be affected.
How do I fix CVE-2018-8373?
Apply the August 2018 cumulative security update from Microsoft. Consider disabling VBScript in Internet Explorer security zones and migrating to a modern browser that does not support VBScript.
How severe is CVE-2018-8373?
CVE-2018-8373 is a critical remote code execution vulnerability that was exploited as a zero-day. The VBScript memory corruption can be triggered through web browsing or document opening, making it an effective attack vector for both mass and targeted campaigns.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.