XXE attack in Microsoft Windows and Windows Server - CVE-2018-0878

Vulnerability details

The vulnerability allows a remote attacker to perform XXE attack on the target system.

The vulnerability exists due to Windows Remote Assistance incorrectly processes XML External Entities (XXE). A remote attacker can send a specially crafted Remote Assistance invitation file to a user and then steal text files from known locations on the victim's machine, under the context of the user, or alternatively, steal text information from URLs accessible to the victim.

Affected software

How to mitigate CVE-2018-0878

Links to Public Exploits and PoC-codes

• Exploit #6240 - Microsoft Windows Remote Assistance - XML External Entity Injection (June 17, 2021)

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0878

Related Security Bulletins

• Information disclosure in Windows Remote Assistance