CVE-2018-0933

Vulnerability

CVE-2018-0933 is a memory corruption vulnerability in the Chakra scripting engine, present in ChakraCore and in Microsoft Edge on Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 [1][2]. The flaw exists when the engine improperly handles objects in memory during script execution, enabling an attacker to corrupt memory in a way that leads to code execution [2][3].

Exploitation

An attacker can exploit this vulnerability by hosting a specially crafted website (or by leveraging a compromised website that accepts user content) and convincing a user to visit it, typically via email or instant message lure [2][3]. The attacker must craft malicious JavaScript/HTML that triggers the object memory handling error in the Chakra engine when rendered by Microsoft Edge or an application embedding ChakraCore [2][3]. No additional privileges or user interaction beyond browsing to the malicious page are required [2].

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the current user [1][3]. Depending on the user's privileges, the attacker could install programs; view, change, or delete data; or create new accounts with full user rights [2]. The compromise is limited to the security context of the logged-on user, but if the user has administrative rights the attacker can gain complete control of the system [2][3].

Mitigation

Microsoft released security updates for the affected Windows platforms and ChakraCore as part of the March 2018 Patch Tuesday [1][3]. All users should apply the latest cumulative update for Windows 10 or Windows Server 2016 to protect against this vulnerability [1][3]. ChakraCore users should update to version 1.8.1 or later [4]. No workarounds are available; the only mitigation is to install the vendor-provided patches [3].