Description
Microsoft Internet Explorer 10 and 11 load different files for attempts to open a file:// URL depending on whether the file exists, which allows local users to enumerate files via vectors involving a file:// URL and an HTML5 sandbox iframe, aka "Internet Explorer Information Disclosure Vulnerability."
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Internet Explorer Iframe Sandbox File Name Disclosure Vulnerability
auxiliary/gather/ie_sandbox_findfiles
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- MS16-095 vendor-advisory
- 1036562 vdb-entry
- https://www.securify.nl/advisory/SFY20160301/internet_explorer_iframe_sandbox_local_file_name_disclosure_vulnerability.html
- 20160809 Internet Explorer iframe sandbox local file name disclosure vulnerability mailing-list
- 20160809 Internet Explorer iframe sandbox local file name disclosure vulnerability mailing-list
- 92291 vdb-entry