cbcvebase.
CVE-2017-11809
published 2017-10-13

CVE-2017-11809: ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the…

PriorityP270high7.5CVSS 3.0
AVNACHPRNUIRSUCHIHAH
EXPLOIT
EPSS
68.03%
99.2th percentile
ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.

Affected

15 ranges
VendorProductVersion rangeFixed in
microsoftchakracore< 1.7.31.7.3
microsoftchakracore<= 1.7.2
microsoftinternet_explorer
microsoftinternet_explorer
microsoftinternet_explorer
msrcchakracore
msrcmicrosoft_edge_on_windows_10_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_for_x64-based_systems
msrcmicrosoft_edge_on_windows_10_version_1511_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1511_for_x64-based_systems
msrcmicrosoft_edge_on_windows_10_version_1607_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1607_for_x64-based_systems
msrcmicrosoft_edge_on_windows_10_version_1703_for_32-bit_systems
msrcmicrosoft_edge_on_windows_10_version_1703_for_x64-based_systems
msrcmicrosoft_edge_on_windows_server_2016

Detection & IOCsextracted from sources · hover to see the quote

  • The vulnerability is triggered by a JavaScript function that uses nested closures with uninitialized local variables, causing 'StackScriptFunction::BoxState::Box' to access uninitialized pointers. Detection should look for recursive JS patterns with nested closures accessing uninitialized scope slots.
  • The PoC can be exercised via the ChakraCore command-line host with the -NoNative flag, which disables JIT and forces interpreter mode where the bug manifests. Monitor for ch.exe or chakra-based processes launched with '-NoNative' arguments.
  • The vulnerability lies in 'StackScriptFunction::BoxState::Box' within the Chakra scripting engine interpreter loop (InterpreterStackFrame). Monitor for crashes or memory corruption events originating from this code path in chakra.dll / ChakraCore.
  • In a web-based attack scenario, the attacker hosts a specially crafted website or embeds an ActiveX control marked 'safe for initialization' to exploit the vulnerability through a Microsoft browser. Monitor for Edge/IE navigating to unusual sites delivering heavy JS with recursive closure patterns.
  • ·The bug is difficult to trigger in Microsoft Edge in its default (JIT-enabled) configuration; the PoC requires the interpreter to be forced via -NoNative. Real-world exploitation through Edge may require additional techniques to reach the vulnerable code path.
  • ·As of the advisory, the vulnerability had been publicly disclosed but had NOT been observed exploited in the wild. Exploitation likelihood was rated 'More Likely' for the latest software release.

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
ghsa7.5HIGH
osv7.5HIGH
vendor_msrc4.2MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.