CVE-2017-0037
HIGH KEVMicrosoft Edge and Internet Explorer 10-11 - Remote Code Execution via CSS Token Sequence Type Confusion
Title source: llmExploitation Summary
CVE-2017-0037 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 28, 2022. EIP tracks 4 public exploits from researchers including mschenk, Google Security Research, redr2e.
AI-analyzed exploit summary This exploit leverages a memory corruption vulnerability in Internet Explorer (CVE-2017-0059) to achieve remote code execution. It uses heap spraying, ROP chains, and shellcode execution to bypass DEP and execute arbitrary code (e.g., calc.exe).
Description
Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.
Exploits (4)
This exploit leverages a memory corruption vulnerability in Internet Explorer (CVE-2017-0059) to achieve remote code execution. It uses heap spraying, ROP chains, and shellcode execution to bypass DEP and execute arbitrary code (e.g., calc.exe).
This is a proof-of-concept exploit for CVE-2017-0037, a memory corruption vulnerability in Microsoft Internet Explorer. The exploit triggers a crash in MSHTML!Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement by manipulating table properties and column spans, leading to a potential use-after-free condition.
This exploit leverages a memory corruption vulnerability in Internet Explorer (CVE-2017-0059) to achieve remote code execution via a crafted HTML page. It uses heap spraying and ROP chains to bypass DEP and execute shellcode.
This repository provides a detailed technical analysis of CVE-2017-0037, a type confusion vulnerability in Microsoft Edge and Internet Explorer. It includes root cause analysis, patch details, and references to the original PoC by Ivan Fratric of Google Project Zero.
References (10)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H