Windows VCF cards allowing for HTML injection. MICROSOFT BUG REPORT
Details to Reproduce
Windows VCF cards do not properly sanitize email addresses allowing for HTML injection. A corrupt VCF card can cause all the users currently opened files and applications to be closed and their session to be terminated without requiring any accompanying attacker supplied code.
This can be done by crafting the Mailto link to point to Windows “logoff.exe”. The corrupt VCF card can then kill all users applications and also log the target off their computer, if the VCF card is opened in using Windows Contacts and the link is clicked.
The logoff.exe executable lives in “C:\Windows\System32” and can terminate applications and log out users without requiring args.
This probably will affect Windows 7 the most as Windows 10 can possibly default opening VCF files in other programs like (People). However, users can possibly still choose to open the VCF in Contacts by right-click the file.
Note, this exploit requires user interaction.
[Exploit/POC]
“VCF_DoS.py”
dirty_vcf=(
‘BEGIN:VCARD\n’
‘VERSION:4.0\n’
‘FN:Session Terminate PoC — ApparitionSec\n’
‘EMAIL:DoS@microsoft.com\n’
‘END:VCARD’)
f=open(“DoS.vcf”, “w”)
f.write(dirty_vcf)
f.close()
print “VCF Denial Of Service card created!”
print “By Humayun Ali Khan”
Status:Complete
Date Reported:Sun Jul 05 2020
Security Impact:Denial of Service
Reported Products:Windows
