Hello, welcome to the Tuesday, October 16th, 2018 edition of the San Sanct Storm Center's Stormcast.

My name is Johannes Ulrich and the day I'm recording from McLean, Virginia.

Today, Abdul Rahman Al-Kamandhi did publish a proof-of-concept exploit for one particular vulnerability that Microsoft patched last week.

This is actually one of those vulnerabilities that didn't really get a lot of attention

because it was one of many issues in Microsoft Edge that was patched.

And the vulnerability was described as an insufficient UI warning.

Now, what is really referred to was that with custom URL schemes, you can launch external

programs and load arbitrary scripts that are already present on the machine.

And in this particular case case the author of this

proof of concept exploit was actually able to use an existing script on the system that is

vulnerable to Windows shell injection to then leverage this flaw in Microsoft Edge.

So not a real straightforward exploit,

but once you see it working,

not really all that difficult

to actually get to work

with not too much user interaction,

so you can probably make this work

relatively reliable.

As so often, once you chain a number of vulnerabilities that by themselves,

don't really look all that severe together, you can, like in this case, have full remote code

execution. So again, this vulnerability was patched last week, so better get going and make

sure that all your systems are up to date.

...