cbcvebase.
CVE-2021-33742
published 2021-06-08

CVE-2021-33742: Windows MSHTML Platform Remote Code Execution Vulnerability

PriorityP188high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2021-11-17
Exploited in the wild
EPSS
59.14%
99.0th percentile
Windows MSHTML Platform Remote Code Execution Vulnerability

Affected

51 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10_1507< 10.0.10240.1896710.0.10240.18967
microsoftwindows_10_1607< 10.0.14393.446710.0.14393.4467
microsoftwindows_10_1809< 10.0.17763.199910.0.17763.1999
microsoftwindows_10_1909< 10.0.18363.162110.0.18363.1621
microsoftwindows_10_2004< 10.0.19041.105210.0.19041.1052
microsoftwindows_10_20h2< 10.0.19042.105210.0.19042.1052
microsoftwindows_10_21h1< 10.0.19043.105210.0.19043.1052
microsoftwindows_10_version_1507>= 10.0.0 < 10.0.10240.1896710.0.10240.18967
microsoftwindows_10_version_1607>= 10.0.0 < 10.0.14393.446710.0.14393.4467
microsoftwindows_10_version_1809>= 10.0.0 < 10.0.17763.199910.0.17763.1999
microsoftwindows_10_version_1909>= 10.0.0 < 10.0.18363.162110.0.18363.1621
microsoftwindows_10_version_2004>= 10.0.0 < 10.0.19041.105210.0.19041.1052
microsoftwindows_10_version_20h2>= 10.0.0 < 10.0.19042.105210.0.19042.1052
microsoftwindows_10_version_21h1>= 10.0.0 < 10.0.19043.105210.0.19043.1052
microsoftwindows_7>= 6.1.0 < 6.1.7601.256326.1.7601.25632
microsoftwindows_7>= 6.1.0 < publicationpublication
microsoftwindows_7_service_pack_1>= 6.1.0 < 6.1.7601.256326.1.7601.25632
microsoftwindows_7_service_pack_1>= 6.1.0 < publicationpublication
microsoftwindows_8.1>= 6.3.0 < 6.3.9600.200456.3.9600.20045
microsoftwindows_8.1>= 6.3.0 < 1.0.0.01.0.0.0
microsoftwindows_server_2008
microsoftwindows_server_2008
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.0 < 6.1.7601.256326.1.7601.25632
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.0 < publicationpublication
microsoftwindows_server_2008_service_pack_2>= 6.0.0 < 6.0.6003.211376.0.6003.21137

Detection & IOCsextracted from sources · hover to see the quote

domainitt[.]uz
snort
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT IE MSHTML Out-of-Bounds Write Inbound (CVE-2021-33742)"; flow:established,to_client; file.data; content:"innerHTML|20|=|20|Array|28|"; nocase; fast_pattern; byte_test:0,>=,33554431,0,string,dec,relative; content:"|29|.toString|28 29 3b|"; within:50; reference:url,googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2021/CVE-2021-33742.html; reference:cve,2021-33742; classtype:attempted-admin; sid:2033326; rev:2; metadata:created_at 2021_07_15, cve CVE_2021_33742, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)
bytes
innerHTML|20|=|20|Array|28|
  • Exploit traffic is inbound HTTP to client (to_client), indicating server-to-browser delivery of the exploit payload. Detection should focus on HTTP response bodies containing the pattern `innerHTML = Array(` followed by a large decimal integer (>=33554431) and `.toString();`.
  • CVE-2021-33742 is an out-of-bounds write in the Windows MSHTML platform (Internet Explorer / WebBrowser control). Exploitation has been detected in the wild against both latest and older software releases.
  • CVE-2021-33742 was exploited as part of Candiru's DevilsTongue spyware deployment chain, including watering hole attacks against media and civil society websites. Hunt for DevilsTongue C2 infrastructure indicators alongside MSHTML exploit detections.
  • ·The Snort/ET rule carries only 'Medium' confidence per its own metadata; tune byte_test threshold and environment scope before deploying in block mode.
  • ·The MSHTML platform is still present and exploitable even on systems where Internet Explorer 11 has been retired, because it is used by IE mode in Edge and by applications using the WebBrowser control.
  • ·Customers installing Security Only updates must also install the IE Cumulative Update to be fully protected against this vulnerability.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vulncheck7.5HIGH
cisa8.8HIGH
vendor_msrc7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.