CVE-2020-0674
HIGH KEVInternet Explorer - Remote Code Execution via Scripting Engine Memory Corruption
Title source: llmExploitation Summary
CVE-2020-0674 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021. EIP tracks 6 public exploits from researchers including Forrest Orr, maxpl0it, Neko-chanQwQ.
AI-analyzed exploit summary This is a 64-bit exploit for CVE-2020-0674 targeting Microsoft Internet Explorer 8/11 and the WPAD service on Windows 7 and 8.1 x64. It leverages a use-after-free vulnerability to achieve remote code execution, bypassing DEP, ASLR, and CFG.
Description
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0710, CVE-2020-0711, CVE-2020-0712, CVE-2020-0713, CVE-2020-0767.
Exploits (6)
This is a 64-bit exploit for CVE-2020-0674 targeting Microsoft Internet Explorer 8/11 and the WPAD service on Windows 7 and 8.1 x64. It leverages a use-after-free vulnerability to achieve remote code execution, bypassing DEP, ASLR, and CFG.
This is a functional exploit for CVE-2020-0674, a use-after-free vulnerability in Microsoft Internet Explorer 11. The exploit leverages a garbage collection issue in Array.sort() to achieve remote code execution by manipulating memory structures and executing calc.exe.
This repository contains a proof-of-concept exploit for CVE-2020-0674, a use-after-free vulnerability in the legacy jscript engine of Internet Explorer. The exploit targets Windows 7 with specific IE configurations and is designed to pop calc.exe.
This PoC automates the testing of CVE-2020-0674, a remote code execution vulnerability in Internet Explorer, by using Selenium to open a malicious HTML file or URL in IE11. It requires user input for the HTML path or URL and the IE driver path.
This repository contains a proof-of-concept exploit for CVE-2020-0674, a use-after-free vulnerability in the legacy jscript engine of Internet Explorer. The exploit targets Windows 7 with specific IE configurations and is designed to pop calc.exe.
References (6)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H