CVE-2020-1380

What is Internet Explorer's Scripting Engine?

Internet Explorer's JScript scripting engine (jscript9.dll) parses and executes JavaScript-like code embedded in web pages — the same category of component as Chromium's V8, and just as frequently a source of memory-corruption vulnerabilities exploitable via nothing more than a victim visiting a malicious page.

Overview

CVE-2020-1380 is a use-after-free vulnerability (CWE-787, though commonly described in this context as UAF) in Internet Explorer's scripting engine, allowing remote code execution in the context of the current user via a crafted web page (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High). Kaspersky's Global Research and Analysis Team (GReAT) discovered it being exploited in the wild in August 2020 as the renderer-compromise half of a two-stage exploit chain dubbed "Operation PowerFall," paired with a Windows kernel privilege-escalation bug to achieve full system compromise. Microsoft patched it in the August 2020 Patch Tuesday.

Technical Details

The vulnerability allows a specially crafted web page, when rendered by Internet Explorer (or an application embedding its rendering engine), to trigger a use-after-free condition in the JScript engine that an attacker can exploit for code execution within the browser process. On its own this grants code execution only with the current user's privileges and inside whatever sandboxing IE applies — full system compromise in the observed attack required pairing it with CVE-2020-0986 (also enriched on this site), a separate Windows GDI print spooler privilege-escalation bug.

Discovery

Discovered by Kaspersky's GReAT team, who identified the vulnerability being used in a real-world watering-hole attack against South Korean users and reported it to Microsoft.

Exploitation Context

Kaspersky's "Operation PowerFall" research documented the full attack chain: victims visiting a compromised legitimate website were served the IE exploit, which achieved initial code execution, followed by exploitation of CVE-2020-0986 to escalate to full system privileges. This is a clear real-world example of the standard two-stage architecture (browser RCE + kernel privilege escalation) also seen in other browser exploitation chains documented on this site.

Remediation

1. Apply Microsoft's August 2020 Patch Tuesday update immediately if not already installed.
2. Migrate away from Internet Explorer where possible — Microsoft has deprecated IE in favor of Edge, and legacy IE rendering (including via embedded WebBrowser controls in other applications) carries substantially higher risk than modern, actively-maintained browsers.
3. Patch the operating system alongside the browser — see CVE-2020-0986 for the privilege-escalation half of this documented exploit chain.
4. Be alert to watering-hole style attacks — Operation PowerFall was delivered via a compromised legitimate website rather than a phishing link, a reminder that trusted, frequently-visited sites can themselves become attack vectors.