CVE-2017-0022

What Is Microsoft XML Core Services (MSXML)?

Microsoft XML Core Services (MSXML) is the Windows XML parsing library used by Internet Explorer, Office, and many Windows applications to parse and process XML documents. MSXML is a COM-based library callable from JavaScript (new ActiveXObject("Msxml2.DOMDocument")), VBScript, and native code. Because MSXML is available via script in Internet Explorer, vulnerabilities in MSXML are accessible through malicious web pages — making MSXML a recurring source of browser-exploitable information disclosure and memory corruption vulnerabilities.

Overview

CVE-2017-0022 is an information disclosure vulnerability in Microsoft XML Core Services (MSXML) where improper object handling in memory allows an attacker to test for the existence of files on disk via a malicious web page. When a user visits a crafted web page that invokes MSXML via JavaScript or ActiveX, the MSXML library improperly processes XML data in memory, potentially exposing the presence or absence of specific filesystem paths — a classic technique for bypassing ASLR by confirming module presence before mounting a memory corruption exploit. Patched in the March 2017 Windows security update. CISA added CVE-2017-0022 to the KEV catalog in May 2022.

Affected Versions

Technical Details

Root Cause: MSXML Memory Object Handling Information Leak

CVE-2017-0022 is an information disclosure vulnerability (CWE-200) arising from how MSXML handles objects in memory. MSXML processes XML documents by parsing them into DOM trees (Document Object Model) in memory, managing nodes, attributes, and text content as COM objects. Under specific conditions triggered by crafted XML, MSXML's memory handling exposes information about system state — specifically, the ability to probe whether specific files exist on the local filesystem.

File existence probing via MSXML: The vulnerability allows a malicious web page (accessed in Internet Explorer) to determine whether specific files or DLLs are present on the victim's system by exploiting a timing or error difference in MSXML's handling of XML that references local file paths. A JavaScript payload can probe for:

• Security software installations (AV engine DLLs, EDR drivers)
• Windows components and optional features
• Module presence for ASLR bypass (kernel32.dll, ntdll.dll base addresses via indirect probing)

Role in exploit chains: Information disclosure vulnerabilities like CVE-2017-0022 are valuable as ASLR bypass tools in exploit chains:

1. Probe for specific DLL or module presence at known ASLR-randomized locations
2. Use the disclosed information to determine the memory layout of the target process
3. Use the known layout to aim a subsequent memory corruption exploit at the correct address

Attack Characteristics

Discovery

Identified through Microsoft's internal security research or external coordinated disclosure; patched in March 2017 Patch Tuesday alongside other MSXML and IE vulnerabilities.

Exploitation Context

• ASLR bypass in exploit kit chains: Information disclosure vulnerabilities in MSXML were incorporated into exploit kits as ASLR bypass techniques — probing file existence to determine which DLLs are loaded at what addresses, defeating Windows ASLR before applying a memory corruption payload
• Exploit kit evolution: Exploit kits (Angler, Magnitude, RIG) continuously updated their MSXML file probing techniques as Microsoft patched each disclosure variant; CVE-2017-0022 represents one iteration in this ongoing cat-and-mouse game
• Internet Explorer targeting: CVE-2017-0022 required Internet Explorer as the attack vector; while IE market share declined through 2017, it remained significant in enterprise environments where IE was mandated for compatibility with internal web applications
• CISA KEV (2022): Added May 2022 based on documented use in active exploit kit campaigns where MSXML file probing was part of a multi-stage exploitation chain

Remediation

1. Apply March 2017 Windows cumulative update — install the March 2017 security update for Windows via Windows Update or WSUS. All subsequent cumulative updates include this fix.

2. Migrate away from Internet Explorer — IE is the required attack vector for MSXML script exploitation; migrating to Microsoft Edge, Chrome, or Firefox eliminates this attack surface. Microsoft ended Internet Explorer 11 desktop support on June 15, 2022.

3. Disable MSXML ActiveX in Internet Explorer — configure IE Enhanced Protected Mode and restrict ActiveX controls through Group Policy to reduce MSXML exposure from IE.

4. Keep Windows fully updated — all current Windows cumulative updates include MSXML security patches.