CVE-2020-0968

What is Internet Explorer's Scripting Engine?

Internet Explorer's scripting engine parses and executes JavaScript-like code embedded in web pages. As one of the oldest and most heavily scrutinized pieces of browser code still in active use, it has produced a long-running stream of memory-corruption vulnerabilities over the years, of which this is one instance from the same general 2020 period as CVE-2020-1380 (Operation PowerFall, also enriched on this site) — a distinct, earlier vulnerability rather than the same bug.

Overview

CVE-2020-0968 is a memory corruption vulnerability (CWE-787) in Internet Explorer's scripting engine, allowing remote code execution via a specially crafted web page (CVSS 3.1: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.5 High). It was reported to Microsoft ahead of the fix shipping in April 2020 Patch Tuesday.

Technical Details

The vulnerable code mishandles objects in memory while executing scripting content, allowing a specially crafted page to trigger memory corruption that an attacker can exploit for code execution in the context of the current IE user. The "High" attack complexity reflects that reliable exploitation requires more precise conditions to trigger than a straightforward, low-complexity memory bug.

Discovery

Reported to Microsoft ahead of the April 2020 Patch Tuesday fix; IE scripting engine vulnerabilities from this era were frequently discovered and reported by external security researchers, including Google's Threat Analysis Group, which was active in identifying browser 0-days used in real-world attacks throughout 2020.

Exploitation Context

CISA added this CVE to KEV in November 2021 based on confirmed exploitation. IE memory-corruption bugs of this kind were a recurring target for both opportunistic drive-by exploit kits and more targeted attack campaigns throughout this period, given IE's continued presence on enterprise systems long after Microsoft began recommending Edge as the primary browser.

Remediation

1. Apply Microsoft's April 2020 Patch Tuesday update immediately if not already installed.
2. Migrate away from Internet Explorer where organizationally feasible — legacy IE rendering, including via embedded WebBrowser controls in other applications, carries materially higher risk than actively maintained modern browsers.
3. Restrict or disable IE where it's no longer needed for legacy application compatibility, reducing the population of vulnerable rendering engines in your environment.
4. Apply the same patching urgency to browser engines as to other internet-facing software — IE scripting engine bugs were a recurring, actively-exploited vulnerability class throughout 2020.