CVE-2020-0713
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on affected systems by exploiting memory corruption in the ChakraCore scripting engine. Attackers could gain control of the system through specially crafted web content. This primarily affects systems running Microsoft Edge browser with ChakraCore.
💻 Affected Systems
- Microsoft Edge
- ChakraCore
📦 What is this software?
Chakracore by Microsoft
Edge by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install programs, view/change/delete data, or create new accounts with full user rights.
Likely Case
Attackers execute malicious code in the context of the current user, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
If Mitigated
With proper security controls like application whitelisting and least privilege, impact is limited to the compromised user context without system-wide access.
🎯 Exploit Status
Exploitation requires user interaction (visiting a malicious website) but no authentication. Memory corruption vulnerabilities in scripting engines are commonly exploited in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: February 2020 security update for Microsoft Edge
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0713
Restart Required: Yes
Instructions:
1. Apply the February 2020 security update for Microsoft Edge through Windows Update. 2. Alternatively, upgrade to Chromium-based Microsoft Edge which is not affected.
🔧 Temporary Workarounds
Disable JavaScript
windowsDisable JavaScript in Microsoft Edge to prevent exploitation through web content
Use alternative browser
windowsSwitch to Chromium-based Microsoft Edge or another modern browser
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized code execution
- Configure Microsoft Edge to run in Enhanced Security Configuration mode
🔍 How to Verify
Check if Vulnerable:
Check Microsoft Edge version in Settings > About Microsoft Edge. If version is prior to the February 2020 update, system is vulnerable.Check Version:
msedge --versionVerify Fix Applied:
Verify Windows Update history shows the February 2020 security update for Microsoft Edge is installed.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from Microsoft Edge
- Memory access violations in Edge processes
- Suspicious PowerShell or command execution from browser context
Network Indicators:
- Outbound connections to known malicious domains from Edge processes
- Unusual HTTP requests to exploit hosting sites
SIEM Query:
Process Creation where ParentImage contains 'msedge.exe' and (CommandLine contains 'powershell' or CommandLine contains 'cmd')