CVE-2004-0380
published 2004-05-04CVE-2004-0380: The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute…
PriorityP265critical10CVSS 2.0
AVNACLAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
63.25%
99.1th percentile
The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | outlook_express | — | — |
| microsoft | outlook_express | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploit URI patterns combining MHTML and ITS protocol handlers — look for 'ms-its:mhtml:file://' in HTTP traffic, email bodies, or HTML content, as this is the canonical exploit string for CVE-2004-0380. ↗
- →Flag any URI referencing ITS protocol handlers (ms-its:, ms-itss:, its:, mk:@MSITStore:) combined with MHTML or CHM file references, especially those pointing to remote hosts. ↗
- →Monitor for delivery or execution of CHM files fetched via ITS protocol URI handlers from remote or untrusted locations, as the exploit chain delivers a malicious CHM containing scripted payloads. ↗
- →Detect encoded variants of the exploit URI (percent-encoded characters in the ms-its/mhtml string) which may bypass simple string-match filters. ↗
- →Inspect MHTML file URIs referencing non-existent resources (e.g., file://C:\<nonexistent>.MHT) as the vulnerability is triggered by the component failing to securely handle such references. ↗
- ·The vulnerability is present even if Microsoft Outlook has been removed as the default email client, because the affected MHTML handler component is shared with Internet Explorer. ↗
- ·Internet Explorer on Windows Server 2003 (with its hardened configuration) is still reported vulnerable to this attack. ↗
- ·Web browsers other than Internet Explorer may also invoke the OS-level URI handlers for the ITS protocol, broadening the attack surface beyond IE. ↗
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wv58-cxvm-2w2g: The MHTML protocol handler in Microsoft Outlook Express 5
ghsa_unreviewed·2022-04-29
CVE-2004-0380 [HIGH] GHSA-wv58-cxvm-2w2g: The MHTML protocol handler in Microsoft Outlook Express 5
The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."
VulnCheck
Microsoft Outlook Express MHTML URL Processing Vulnerability
vulncheck·2004·CVSS 10.0
CVE-2004-0380 [CRITICAL] Microsoft Outlook Express MHTML URL Processing Vulnerability
Microsoft Outlook Express MHTML URL Processing Vulnerability
The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."
Affected: Microsoft outlook_express
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.exploit-db.com/exploits/23695
No detection rules found.
Exploit-DB
Microsoft Internet Explorer 5.0.1 - ITS Protocol Zone Bypass (MS04-013)
exploitdb·2004-02-13
CVE-2004-0380 Microsoft Internet Explorer 5.0.1 - ITS Protocol Zone Bypass (MS04-013)
Microsoft Internet Explorer 5.0.1 - ITS Protocol Zone Bypass (MS04-013)
---
source: https://www.securityfocus.com/bid/9658/info
Microsoft Internet Explorer has been reported prone to a vulnerability that may permit hostile content to be interpreted in the Local Zone.
The issue may be exploited via the ITS (InfoTech Storage) Protocol URI handler. It is possible to use this protocol to force a browser into the Local Zone by redirecting into a non-existent MHTML file (using other known vulnerabilities). In this manner, it may be possible to reference hostile content to be executed in the Local Zone, such as a malicious CHM file. The issue, in combination with other vulnerabilities, is exploitable to provide for automatic delivery and execution of an arbitrary executable. This would occur
Exploit-DB
Microsoft Outlook Express 6.0 - MHTML Forced File Execution (2)
exploitdb·2003-11-25
CVE-2004-0380 Microsoft Outlook Express 6.0 - MHTML Forced File Execution (2)
Microsoft Outlook Express 6.0 - MHTML Forced File Execution (2)
---
source: https://www.securityfocus.com/bid/9105/info
A vulnerability has been discovered in Microsoft Outlook Express when handling MHTML file and res URIs that could lead to an unexpected file being downloaded and executed.
The problem occurs due to the component failing to securely handle MHTML file URIs that reference a non-existent resource. The affected Outlook Express component is used by Microsoft Internet Explorer. As a result, a victim browser user may inadvertently access a page designed to load an embedded object from a malicious location. This would effectively result in the execution of attacker-supplied code within the Local Zone. The vulnerability is present even if Microsoft Outlook has been removed as t
Exploit-DB
Microsoft Outlook Express 6.0 - '.MHTML' Forced File Execution (1)
exploitdb·2003-11-25
CVE-2004-0380 Microsoft Outlook Express 6.0 - '.MHTML' Forced File Execution (1)
Microsoft Outlook Express 6.0 - '.MHTML' Forced File Execution (1)
---
source: https://www.securityfocus.com/bid/9105/info
A vulnerability has been discovered in Microsoft Outlook Express when handling MHTML file and res URIs that could lead to an unexpected file being downloaded and executed.
The problem occurs due to the component failing to securely handle MHTML file URIs that reference a non-existent resource. The affected Outlook Express component is used by Microsoft Internet Explorer. As a result, a victim browser user may inadvertently access a page designed to load an embedded object from a malicious location. This would effectively result in the execution of attacker-supplied code within the Local Zone. The vulnerability is present even if Microsoft Outlook has been removed a
No writeups or analysis indexed.
http://secunia.com/advisories/10523http://www.k-otik.net/bugtraq/02.18.InternetExplorer.phphttp://www.kb.cert.org/vuls/id/323070http://www.securityfocus.com/archive/1/354447http://www.securityfocus.com/archive/1/358913http://www.securityfocus.com/bid/9105http://www.securityfocus.com/bid/9658http://www.us-cert.gov/cas/techalerts/TA04-104A.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-013https://exchange.xforce.ibmcloud.com/vulnerabilities/15705https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1010https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1028https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A882https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A990http://secunia.com/advisories/10523http://www.k-otik.net/bugtraq/02.18.InternetExplorer.phphttp://www.kb.cert.org/vuls/id/323070http://www.securityfocus.com/archive/1/354447http://www.securityfocus.com/archive/1/358913http://www.securityfocus.com/bid/9105http://www.securityfocus.com/bid/9658http://www.us-cert.gov/cas/techalerts/TA04-104A.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-013https://exchange.xforce.ibmcloud.com/vulnerabilities/15705https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1010https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1028https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A882https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A990
2004-05-04
Published
Exploited in the wild