CVE-2008-2281

published 2008-05-18

CVE-2008-2281: Cross-zone scripting vulnerability in the Print Table of Links feature in Internet Explorer 6.0, 7.0, and 8.0b allows user-assisted remote attackers to inject…

Priority P3 44 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

EXPLOIT

Cross-zone scripting vulnerability in the Print Table of Links feature in Internet Explorer 6.0, 7.0, and 8.0b allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via an HTML document with a link containing JavaScript sequences, which are evaluated by a resource script when a user prints this document.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
microsoft	ie	—	—
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—

Detection & IOCs extracted from sources · hover to see the quote

command new ActiveXObject('WScript.Shell');x.Run('calc.exe');↗

• → Detect JavaScript ActiveXObject instantiation of WScript.Shell within HTML link href attributes, which is the injection vector for this cross-zone scripting attack via the Print Table of Links feature. ↗
• → Alert on use of window.print() in combination with ActiveXObject('WScript.Shell') or ActiveXObject('Wscript.Shell') in the same HTML document, as this is the PoC trigger pattern for CVE-2008-2281. ↗
• → Monitor for Internet Explorer spawning calc.exe or other unexpected child processes via WScript.Shell.Run(), which indicates successful exploitation of the Local Machine Zone cross-zone scripting vulnerability. ↗

• · The vulnerability affects Internet Explorer 6.0, 7.0, and 8.0b specifically; exploitation requires user interaction (user must print the malicious document). ↗
• · Injected JavaScript sequences are evaluated in the Local Machine Zone context only when the user triggers the Print Table of Links feature, not on normal page load. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.