CVE-2015-0072

Vulnerability

CVE-2015-0072 is a universal cross-site scripting (UXSS) vulnerability affecting Microsoft Internet Explorer 9 through 11. It allows remote attackers to bypass the Same Origin Policy (SOP) by leveraging a sequence involving an IFRAME element that triggers a redirect, a second IFRAME that does not redirect, and an eval of a WindowProxy object [1][4]. The vulnerability was disclosed by researcher David Leo and demonstrated on Internet Explorer 11 on Windows 7 and 8.1 [4].

Exploitation

An attacker hosts a specially crafted webpage containing two IFRAMEs: one navigates to a target domain, the other remains same-origin. By closing a popup dialog and clicking a link, after approximately 7 seconds the attacker’s script is injected into the target domain’s window [4]. The attack requires no authentication or special privileges, only that the victim visits the malicious page and performs the user interaction (closing the popup and clicking). The injected script can then read and write content from the target domain, including HTTPS pages [2].

Impact

Successful exploitation completely bypasses the Same Origin Policy, allowing an attacker to execute arbitrary JavaScript in the context of any website visited by the victim. This can be used to steal sensitive data (e.g., login credentials, session tokens), perform phishing attacks by injecting fake forms, or hijack user accounts on sites such as banks or email services [2]. The browser’s address bar continues to display the legitimate domain, making the attack highly convincing [2].

Mitigation

Microsoft addressed this vulnerability in Security Bulletin MS15-018, released on March 10, 2015 [1]. The update (KB3032359) modifies how Internet Explorer enforces cross-domain policies. Users should apply the update via Windows Update. Prior to patching, no practical workaround was available; users could mitigate risk by avoiding untrusted websites or using an alternative browser. The vulnerability is not known to be exploited in the wild at the time of disclosure [4].