Exploitation Summary
CVE-2019-0752 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 15, 2022, with confirmed use in ransomware campaigns. EIP tracks 3 public exploits from researchers including Simon Zuckerbraun, edxsh.
AI-analyzed exploit summary This exploit leverages a memory corruption vulnerability in Internet Explorer's scripting engine to achieve arbitrary write primitives, ultimately leading to remote code execution via PowerShell. It uses CVE-2019-0768 to bypass mitigations and execute VBScript on Windows 10 1809.
Description
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0753, CVE-2019-0862.
Exploits (3)
This exploit leverages a memory corruption vulnerability in Internet Explorer's scripting engine to achieve arbitrary write primitives, ultimately leading to remote code execution via PowerShell. It uses CVE-2019-0768 to bypass mitigations and execute VBScript on Windows 10 1809.
This PoC exploits CVE-2019-0752, a write-what-where vulnerability in Internet Explorer 11, allowing RCE without native code execution. It dynamically creates DOM elements via JavaScript to bypass static HTML and avoids PowerShell usage through address manipulation.
The repository provides a technical summary and reference to a blog post detailing the exploitation of CVE-2019-0752, a write-what-where vulnerability in Internet Explorer 11. It describes the use of JavaScript to dynamically create DOM elements and avoid static HTML, targeting Windows 10 systems up to RS4/RS5.
References (4)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H