CVE-2014-0257
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1 - Remote Code Execution via Type Traversal
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2014-0257.
PoCs published by Metasploit, James Forshaw, juan vazquez, including Metasploit module exploits/windows/local/ms14_009_ie_dfsvc.
AI-analyzed exploit summary This Metasploit module exploits CVE-2014-0257, a .NET Deployment Service vulnerability in Internet Explorer's Enhanced Protected Mode, allowing sandbox escape and execution of arbitrary code with Medium Integrity. It checks for vulnerable .NET versions (4.5 or 4.5.1) and leverages a DLL payload to achieve exploitation.
Description
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute a method, which allows remote attackers to execute arbitrary code via (1) a crafted web site or (2) a crafted .NET Framework application that exposes a COM server endpoint, aka "Type Traversal Vulnerability."
Exploits (2)
This Metasploit module exploits CVE-2014-0257, a .NET Deployment Service vulnerability in Internet Explorer's Enhanced Protected Mode, allowing sandbox escape and execution of arbitrary code with Medium Integrity. It checks for vulnerable .NET versions (4.5 or 4.5.1) and leverages a DLL payload to achieve exploitation.
This Metasploit module exploits CVE-2014-0257, a sandbox escape vulnerability in Internet Explorer's .NET Deployment Service (dfsvc.exe), allowing code execution at Medium Integrity from Low Integrity. It checks for vulnerable .NET versions, loads a malicious DLL, and executes a PowerShell payload.