PT-2018-1311 · Google+3 · Google Chrome+5

Smgorelik · Published 2018-05-08 · Updated 2025-10-28 · CVE-2018-8174

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows VBScript Engine versions prior to the fixed version

Description A remote code execution issue exists in the way the VBScript engine handles objects in memory. This allows remote attackers to execute arbitrary code and affect the system. The vulnerability has been exploited in real-world incidents, including a malvertising campaign to deliver GandCrab ransomware. The campaign, known as Operation Earth Kitsune, involved exploiting the vulnerability to infect systems, which then communicated with attackers through GitHub and reported back through a closed Slack chat. The attackers also used 1-day vulnerabilities in Chrome and IE to spread malware.

Recommendations For Microsoft Windows VBScript Engine versions prior to the fixed version, apply the official fix to resolve the issue. As a temporary workaround, consider restricting access to the VBScript engine or disabling it until a patch is available. Avoid using vulnerable API endpoints, such as Wow64DisableWow64FsRedirection, ExitWindowsEx, ShellExecuteW, CreateProcessW, and CreateProcess, until the issue is resolved.

Exploit

Fix

RCE

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

BDU:2018-00809

CVE-2018-8174

ZDI-18-540

ZDI-18-591

ZDI-18-592

Affected Products

Google Chrome

Github

Ie

Slack

Vbscript Engine

Windows

References · 29

• 🔥 https://github.com/qazbnm456/awesome-cve-poc/blob/master/CVE-2018-8174.md · Exploit
• 🔥 https://github.com/0x09AL/CVE-2018-8174-msf · Exploit
• 🔥 https://github.com/Yt1g3r/CVE-2018-8174_EXP · Exploit
• 🔥 https://github.com/piotrflorczyk/cve-2018-8174_analysis · Exploit
• 🔥 https://github.com/SyFi/CVE-2018-8174 · Exploit
• 🔥 https://github.com/ruthlezs/ie11_vbscript_exploit · Exploit
• 🔥 https://exploit-db.com/exploits/44741 · Exploit
• 🔥 https://blog.0patch.com/2018/05/a-single-instruction-micropatch-for.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-8174 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-540 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-592 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8174 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00809 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-591 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8174 · Vendor Advisory