Skip to content

This Python script exploits a vulnerability (CVE-2024-21388) in Microsoft Edge, allowing silent installation of browser extensions with elevated privileges via a private API.

Notifications You must be signed in to change notification settings

d0rb/CVE-2024-21388

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits
 
 
 
 

Repository files navigation

🇮🇱 #BringThemHome #NeverAgainIsNow 🇮🇱

We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home. https://stories.bringthemhomenow.net/

Microsoft Edge Vulnerability Exploit (CVE-2024-21388)

This Python script exploits a vulnerability (CVE-2024-21388) in Microsoft Edge, allowing silent installation of browser extensions with elevated privileges via a private API.

Description

Guardio Labs discovered a vulnerability in Microsoft Edge, designated CVE-2024–21388. This flaw could have allowed an attacker to exploit a private API, initially intended for marketing purposes, to covertly install additional browser extensions with broad permissions without the user’s knowledge. The vulnerability was promptly disclosed to Microsoft, leading to a resolution in February 2024. https://labs.guard.io/cve-2024-21388-microsoft-edges-marketing-api-exploited-for-covert-extension-installation-879fe5ad35ca

Exploitation Overview

The vulnerability enables anyone with a method to run JavaScript on bing.com or microsoft.com pages to install any extensions from the Edge Add-ons Store without the user’s consent or interaction. This is an "Elevation of Privilege" issue classified as Moderate in severity by the Microsoft Security Response Center (MSRC).

Exploit Method

The script utilizes a private browser API accessible from privileged Microsoft websites to install any desired extension silently, bypassing user consent. By injecting a script into the context of a privileged website like bing.com, the exploit triggers the installation of the selected extension without user interaction.

Usage

  1. Ensure Python is installed on your system.
  2. Clone the repository and navigate to the exploit script.
  3. Edit the script to specify the target extension ID and manifest.
  4. Execute the script using Python.

Disclaimer

This exploit script is for educational purposes only. It should not be used for any malicious activities.

About

This Python script exploits a vulnerability (CVE-2024-21388) in Microsoft Edge, allowing silent installation of browser extensions with elevated privileges via a private API.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages