Exploitation Summary
EIP tracks 3 public exploits for CVE-2014-4936.
PoCs published by Metasploit, 0x3a, Yonathan Klijnsma, Gabor Seljan, todb, including Metasploit module exploits/windows/browser/malwarebytes_update_exec.
AI-analyzed exploit summary This Metasploit module exploits a vulnerability in Malwarebytes Anti-Malware and Anti-Exploit by spoofing the update server to deliver a malicious executable. It intercepts version check requests and serves a fake update containing the payload.
Description
The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable.
Exploits (3)
This Metasploit module exploits a vulnerability in Malwarebytes Anti-Malware and Anti-Exploit by spoofing the update server to deliver a malicious executable. It intercepts version check requests and serves a fake update containing the payload.
This PoC simulates a Malwarebytes CDN to exploit CVE-2014-4936, allowing arbitrary code execution by serving a malicious payload during the update process. It intercepts update requests and forces the client to download and execute a payload.
This Metasploit module exploits a vulnerability in Malwarebytes Anti-Malware and Anti-Exploit by spoofing the update server to deliver a malicious executable. It leverages the lack of proper update package validation to achieve remote code execution.