{"uuid": "d075d6d3-f2d5-4ddd-937d-c9602289507d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-3893", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ie_setmousecapture_uaf.rb", "content": "{\"aliases\": [], \"arch\": \"\", \"author\": [\"Unknown\", \"sinn3r \", \"Rich Lundeen\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a use-after-free vulnerability that currents targets Internet\\n          Explorer 9 on Windows 7, but the flaw should exist in versions 6/7/8/9/10/11.\\n          It was initially found in the wild in Japan, but other regions such as English,\\n          Chinese, Korean, etc, were targeted as well.\\n\\n          The vulnerability is due to how the mshtml!CDoc::SetMouseCapture function handles a\\n          reference during an event. An attacker first can setup two elements, where the second\\n          is the child of the first, and then setup a onlosecapture event handler for the parent\\n          element. The onlosecapture event seems to require two setCapture() calls to trigger,\\n          one for the parent element, one for the child. When the setCapture() call for the child\\n          element is called, it finally triggers the event, which allows the attacker to cause an\\n          arbitrary memory release using document.write(), which in particular frees up a 0x54-byte\\n          memory.  The exact size of this memory may differ based on the version of IE. After the\\n          free, an invalid reference will still be kept and pass on to more functions, eventuall\\n          this arrives in function MSHTML!CTreeNode::GetInterface, and causes a crash (or arbitrary\\n          code execution) when this function attempts to use this reference to call what appears to\\n          be a PrivateQueryInterface due to the offset (0x00).\\n\\n          To mimic the same exploit found in the wild, this module will try to use the same DLL\\n          from Microsoft Office 2007 or 2010 to leverage the attack.\", \"disclosure_date\": \"2013-09-17\", \"fullname\": \"exploit/windows/browser/ie_setmousecapture_uaf\", \"is_install_path\": true, \"mod_time\": \"2025-06-23 12:43:46 +0000\", \"name\": \"MS13-080 Microsoft Internet Explorer SetMouseCapture Use-After-Free\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/browser/ie_setmousecapture_uaf.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/browser/ie_setmousecapture_uaf\", \"references\": [\"CVE-2013-3893\", \"OSVDB-97380\", \"MSB-MS13-080\", \"URL-http://technet.microsoft.com/en-us/security/advisory/2887505\", \"URL-http://blogs.technet.com/b/srd/archive/2013/09/17/cve-2013-3893-fix-it-workaround-available.aspx\", \"URL-https://www.rapid7.com/blog/post/2013/09/30/metasploit-releases-cve-2013-3893-ie-setmousecapture-use-after-free\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Automatic\", \"Windows 7 with Office 2007|2010\", \"Windows XP with IE 8\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:04.351594Z"}