The team at Enki have discovered a vulnerability in Internet Explorer that has been used in campaigns targeting security researchers. The vulnerability has been exploited to use the browser’s render process to execute malicious code and exfiltrate data from the victim machine. It should be noted that this vulnerability stops in the low integrity sandbox, and in order to gain persistence on the machine another exploit must be chained to this attack. What is striking about this initial attack vector is the ease at which it executes. If unsuccessful with the more obvious approach where a user would need to check a popup box approving activity, the exploit can be deployed instantly from a malicious add hosted on a benign website. Phishing email message’s with links that redirect unsuspecting users to malicious web pages are all too common and successful.

This is a double free bug, triggered by JavaScript embedded in an MHTML file that is a default for Internet Explorer to handle. Microsoft developers will have to work to implement a permanent fix for full functionality of the portion affected. In the meantime, a free micro-patch has been released by the developers at 0patch.com. 0patch opted to forgo a more complex and riskier avenue towards mitigation, and instead decided to “break the obscure browser functionality that allows setting an HTML Attribute value to an object.”.