cbcvebase.
CVE-2008-4033
published 2008-11-12

CVE-2008-4033: Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products…

PriorityP431medium4.3CVSS 2.0
AVNACMAuNCPINAN
EXPLOIT
EPSS
27.75%
97.9th percentile
Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, as demonstrated by the Transfer-Encoding field, aka "MSXML Header Request Vulnerability."

Affected

4 ranges
VendorProductVersion rangeFixed in
microsoftxml_core_services——
microsoftxml_core_services——
microsoftxml_core_services——
microsoftxml_core_services——

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://www.milw0rm.com/forfun.dtd↗
  • →Exploit uses ActiveXObject instantiation of Msxml2.DOMDocument.3.0 to load a remote DTD cross-domain, which is the attack primitive for CVE-2008-4033/MS08-069; monitor for script-initiated creation of this ProgID loading remote URLs. ↗
  • →The incomplete fix for CVE-2008-4033 left Set-Cookie2 HTTP response headers accessible via XMLHttpRequest, bypassing HTTPOnly; monitor XMLHttpRequest responses for Set-Cookie2 header exposure from cross-origin requests. ↗
  • ·The exploit payload references a remote DTD hosted on milw0rm.com, which is an attacker-controlled URL used at time of publication (2008-11-23); the domain is no longer active/malicious but illustrates the cross-domain DTD loading vector. ↗
  • ·CVE-2009-0419 is documented as a follow-on incomplete fix for CVE-2008-4033; detections targeting CVE-2008-4033 should also account for the residual Set-Cookie2 bypass described in CVE-2009-0419. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.