{"id":84790,"date":"2017-09-14T14:58:34","date_gmt":"2017-09-14T09:28:34","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=84790"},"modified":"2017-09-14T14:58:34","modified_gmt":"2017-09-14T09:28:34","slug":"cve-2017-8759-net-framework-remote-code-execution-vulnerability-analysis-quick-heal-security-labs","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/cve-2017-8759-net-framework-remote-code-execution-vulnerability-analysis-quick-heal-security-labs\/","title":{"rendered":"CVE-2017-8759 | .NET Framework Remote Code Execution Vulnerability &#8211; An analysis by Quick Heal Security Labs"},"content":{"rendered":"<p>The recent zero-day vulnerability in .NET Framework vulnerability CVE-2017-8759 enables attackers to perform a Remote Code Execution on the targeted machine. This vulnerability is found to be exploited in the wild through email spam messages loaded with malicious RTF files as an attachment. Microsoft has released a security update on September 12, 2017, to fix this issue.<\/p>\n<p><strong>Vulnerable Versions<\/strong><\/p>\n<p>The below versions of Microsoft Frameworks are affected by this vulnerability:<\/p>\n<p>\u2022 Microsoft .NET Framework 2.0 SP2<br \/>\n\u2022 Microsoft .NET Framework 3.5<br \/>\n\u2022 Microsoft .NET Framework 3.5.1<br \/>\n\u2022 Microsoft .NET Framework 4.5.2<br \/>\n\u2022 Microsoft .NET Framework 4.6<br \/>\n\u2022 Microsoft .NET Framework 4.6.1<br \/>\n\u2022 Microsoft .NET Framework 4.6.2\/4.7<br \/>\n\u2022 Microsoft .NET Framework 4.6\/4.6.1\/4.6.2\/4.7<br \/>\n\u2022 Microsoft .NET Framework 4.7<\/p>\n<p><strong>Vulnerability <\/strong><\/p>\n<p>This is a code injection vulnerability in SOAP Moniker which allows an attacker to perform a remote code execution on the targeted machine. After successful exploitation, the attacker can take control of vulnerable system and download and execute programs on the affected system at will.<\/p>\n<p>The malicious RTF document, which is an initial attack vector, makes a request to a CNC server and downloads vulnerable SOAP WSDL content.<\/p>\n<figure id=\"attachment_84794\" aria-describedby=\"caption-attachment-84794\" style=\"width: 884px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-84794 size-full\" src=\"https:\/\/blogs_admin.quickheal.com\/wp-content\/uploads\/2017\/09\/SOAP_req_censored.jpg\" alt=\"Fig 1. SOAP WSDL Content\" width=\"884\" height=\"579\" srcset=\"https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/09\/SOAP_req_censored.jpg 884w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/09\/SOAP_req_censored-300x196.jpg 300w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/09\/SOAP_req_censored-768x503.jpg 768w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/09\/SOAP_req_censored-595x390.jpg 595w, https:\/\/www.quickheal.com\/blogs\/wp-content\/uploads\/2017\/09\/SOAP_req_censored-789x517.jpg 789w\" sizes=\"(max-width: 884px) 100vw, 884px\" \/><figcaption id=\"caption-attachment-84794\" class=\"wp-caption-text\">Fig 1. SOAP WSDL Content<\/figcaption><\/figure>\n<p>The vulnerability triggers while parsing the SOAP WSDL content and malicious payloads get downloaded and executed on the victim\u2019s machine.<\/p>\n<p><strong>Quick Heal Detections<\/strong><\/p>\n<p>Quick Heal has released the following detections for the vulnerability <a href=\"https:\/\/www.cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2017-8759\">CVE-2017-8759<\/a><\/p>\n<ul>\n<li>Virus Protection\n<ul>\n<li>Exp.RTF.CVE-2017-8759<\/li>\n<\/ul>\n<\/li>\n<li>IDS\/IPS\n<ul>\n<li>VID-03201 &#8211; .NET Framework Remote Code Execution Vulnerability<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>The observed payload in the wild delivered after the exploitation of this vulnerability was FINSPY. The payload is detected by Quick Heal as \u201cBackdoor.FinSpy\u201d.<\/p>\n<p>This exploit is already being used in the wild and we expect more malicious campaigns will make use of this vulnerability in the future. Microsoft has patched this vulnerability and <a href=\"https:\/\/portal.msrc.microsoft.com\/en-us\/security-guidance\/advisory\/CVE-2017-8759\">updates are available here<\/a>. We strongly recommend users to apply these updates and also take the latest security updates by Quick Heal.<\/p>\n<p>Subject Matter Expert<\/p>\n<ul>\n<li>Pavankumar Chaudhari <strong>| <\/strong>Quick Heal Security Labs<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>The recent zero-day vulnerability in .NET Framework vulnerability CVE-2017-8759 enables attackers to perform a Remote Code Execution on the targeted machine. This vulnerability is found to be exploited in the wild through email spam messages loaded with malicious RTF files as an attachment. Microsoft has released a security update on September 12, 2017, to fix [&hellip;]<\/p>\n","protected":false},"author":33,"featured_media":84800,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,36,1395],"tags":[1493,718],"class_list":["post-84790","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-security-patch","category-vulnerability","tag-cve-2017-8759","tag-zero-day"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/84790"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/33"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=84790"}],"version-history":[{"count":8,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/84790\/revisions"}],"predecessor-version":[{"id":84801,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/84790\/revisions\/84801"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media\/84800"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=84790"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=84790"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=84790"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}