Attacker Value
Moderate
(1 user assessed)
Exploitability
Moderate
(1 user assessed)
User Interaction
Required
Privileges Required
None
Attack Vector
Network
0

CVE-2018-8174

Disclosure Date: May 09, 2018 •
CVE-2018-8174 CVSS v3 Base Score: 7.5
Exploited in the Wild
Reported by AttackerKB Worker
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka “Windows VBScript Engine Remote Code Execution Vulnerability.” This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Add Assessment

1
Ratings
  • Attacker Value
    Medium
  • Exploitability
    Medium
Common in enterpriseUnauthenticatedVulnerable in default configurationRequires user interaction
Technical Analysis

This vulnerability is a Use-After-Free in the Microsoft VBScript engine. Originally exploited in the wild, attackers used a technique to force the exploit code to be opened with Internet Explorer by embedding a resource into a Rich Text File (RTF). This technique would allow attackers to more reliably exploit targets, even when a non-IE browser was configured as the default.

The Use After Free is related to arbitrary VB object. When two arrays reference the same object, and one array is deleted, the second array is left with a dangling reference.

Log in to Add Reply
CVSS V3 Severity and Metrics
Base Score:
7.5 High
Impact Score:
5.9
Exploitability Score:
1.6
Vector:
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
High
Privileges Required (PR):
None
User Interaction (UI):
Required
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
Windows 7 32-bit Systems Service Pack 1
Windows 7 x64-based Systems Service Pack 1
Windows Server 2012 R2 (Server Core installation)
Windows RT 8.1
Windows Server 2008 32-bit Systems Service Pack 2
Windows Server 2008 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 Itanium-Based Systems Service Pack 2
Windows Server 2008 x64-based Systems Service Pack 2
Windows Server 2008 x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2012 (Server Core installation)
Windows 8.1 32-bit systems
Windows 8.1 x64-based systems
Windows Server 2016 (Server Core installation)
Windows Server 2008 R2 Itanium-Based Systems Service Pack 1
Windows Server 2008 R2 x64-based Systems Service Pack 1
Windows Server 2008 R2 x64-based Systems Service Pack 1 (Server Core installation)
Windows 10 32-bit Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1703 for 32-bit Systems
Windows 10 Version 1703 for x64-based Systems
Windows 10 Version 1709 for 32-bit Systems
Windows 10 Version 1709 for x64-based Systems
Windows 10 Version 1803 for 32-bit Systems
Windows 10 Version 1803 for x64-based Systems
Windows 10 x64-based Systems
Windows 10 Servers version 1709 (Server Core Installation)
Windows 10 Servers version 1803 (Server Core Installation)
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

  • Microsoft

Products

  • Windows 7,
  • Windows Server 2012 R2,
  • Windows RT 8.1,
  • Windows Server 2008,
  • Windows Server 2012,
  • Windows 8.1,
  • Windows Server 2016,
  • Windows Server 2008 R2,
  • Windows 10,
  • Windows 10 Servers

Additional Info

Authenticated
Unknown
Exploitable
Unknown
Reliability
Unknown
Stability
Unknown
Available Mitigations
Unknown
Shelf Life
Unknown
Userbase/Installbase
Unknown
Patch Effectiveness
Unknown
Technical Analysis