Description
The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on Internet Explorer using script in a compiled help (CHM) file that references the InfoTech Storage (ITS) protocol handlers such as (1) ms-its, (2) ms-itss, (3) its, or (4) mk:@MSITStore, aka the "MHTML URL Processing Vulnerability."
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 3
- Microsoft Internet Explorer 5.0.1 - ITS Protocol Zone Bypass (MS04-013) EDB-23695 · remote · Feb 13, 2004 · verified
- Microsoft Outlook Express 6.0 - '.MHTML' Forced File Execution (1) EDB-23400 · remote · Nov 25, 2003 · verified
- Microsoft Outlook Express 6.0 - MHTML Forced File Execution (2) EDB-23401 · remote · Nov 25, 2003 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- oval:org.mitre.oval:def:990 vdb-entry signature
- 9105 vdb-entry
- VU#323070 third-party-advisory
- oval:org.mitre.oval:def:1010 vdb-entry signature
- outlook-mhtml-execute-code(15705) vdb-entry
- MS04-013 vendor-advisory
- 9658 vdb-entry
- TA04-104A third-party-advisory
- oval:org.mitre.oval:def:882 vdb-entry signature
- http://www.k-otik.net/bugtraq/02.18.InternetExplorer.php
- 20040328 IE ms-its: and mk:@MSITStore: vulnerability mailing-list
- 20040219 Microsoft Internet Explorer Unspecified CHM File Processing Arbitrary Code Execution Vulnerability (bid 9658) mailing-list
- oval:org.mitre.oval:def:1028 vdb-entry signature
- 10523 third-party-advisory