Zero-day vulnerability in Microsoft XML Core Services
Information disclosure
CVE-2017-0022
This vulnerability was used in the AdGholas malvertising campaign and later integrated into the Neutrino exploit kit. The vulnerability was reported to Microsoft in September 2016. The first malware sample, discovered in the wild, is connected with AdGholas campaign in July 2016. The exploit came back again in September 2016 with the Neutrino exploit kit.
Neutrino exploit kit
Vulnerability details
Advisory: SB2017031404 - Information disclosure in Microsoft XML Core Services
Vulnerable component: Microsoft XML Core Services
CVE-ID: CVE-2017-0022
CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:H/RL:O/RC:C
CWE-ID: CWE-200 - Information exposure
Description:
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The vulnerability exists due to improper handling of objects in memory by Microsoft XML Core Services (MSXML). A remote unauthenticated attacker can create a specially crafted Web site, trick the victim into visiting it and test for the presence of files on disk.
Successful exploitation of this vulnerability results in information disclosure.
Note: the vulnerability was being actively exploited.
Known APT campaigns:
AdGholas
AdGholas is a name of malvertising campaign active since at least October 2015. To avoid detection the hackers use steganography and file whitelisting techniques. As of April 2017 the hackers employed Astrum exploit kit, according to Trend Micro report.