Exploitation Summary
CVE-2016-0189 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 28, 2022, with confirmed use in ransomware campaigns.
EIP tracks 5 public exploits from researchers including Brian Pak, theori-io, deamwork, including a Metasploit module exploits/windows/browser/ms16_051_vbscript.
AI-analyzed exploit summary This is a functional proof-of-concept exploit for CVE-2016-0189, a VBScript memory corruption vulnerability in Internet Explorer 11. The exploit requires serving specific HTML and DLL files via a web server to trigger the vulnerability, potentially leading to remote code execution.
Description
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.
Exploits (5)
This is a functional proof-of-concept exploit for CVE-2016-0189, a VBScript memory corruption vulnerability in Internet Explorer 11. The exploit requires serving specific HTML and DLL files via a web server to trigger the vulnerability, potentially leading to remote code execution.
This repository contains a functional proof-of-concept exploit for CVE-2016-0189, a VBScript memory corruption vulnerability in Internet Explorer 11. The exploit includes support DLLs for local privilege escalation and a local HTTP server to serve the malicious payload.
This repository contains a functional proof-of-concept exploit for CVE-2016-0189, a VBScript memory corruption vulnerability in Internet Explorer 11. The exploit includes support DLLs for local privilege escalation via a local HTTP server and environment variable manipulation.
This repository contains a functional proof-of-concept exploit for CVE-2016-0189, a VBScript memory corruption vulnerability in Internet Explorer 11. The exploit includes support DLLs for local privilege escalation via a local HTTP server and environment variable manipulation.
This Metasploit module exploits a memory corruption vulnerability (CVE-2016-0189) in the VBScript engine of Internet Explorer 11. It uses a combination of heap spraying and memory manipulation to achieve remote code execution on vulnerable systems.
References (7)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H