CVE-2025-30397# **🚨 CVE-2025-30397 – Critical JScript RCE Vulnerability Exploited in the Wild 💥**
---
### 🔥 CVE-2025-30397 Overview
* **Type**: Type confusion vulnerability
* **Component**: Microsoft Scripting Engine (JScript)
* **Impact**: Remote Code Execution (RCE)
* **Attack Vector**: Remote — triggered via malicious scripts in web content
* **Severity**: CVSS 3.1 score of 7.5 (High)
* **Exploited**: Confirmed in the wild
* **Patched**: May 2025 Patch Tuesday
* **Deadline by CISA**: Patching required before June 3, 2025
---
### 🛠️ Technical Summary
* A type confusion bug in `jscript.dll` leads to memory corruption.
* Exploitable by tricking a user into visiting a specially crafted webpage.
* Common payloads include launching system commands (e.g., spawning calculator).
* Works on legacy systems that still run Internet Explorer or rely on JScript.
---
### 🖥 Affected Systems
* Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
* Windows 11 (22H2, 23H2, 24H2)
* Windows Server (2008 SP2, 2008 R2 SP1, 2012, 2016, 2019, 2022, 2025)
---
### 🚨 Exploitation
* Proof-of-concept (PoC) code is public.
* Attackers can remotely execute code under the privileges of the user.
* Can be used in phishing attacks or embedded in malicious websites.
---
### ✅ Mitigation & Remediation
* Apply Microsoft’s May 2025 security updates.
* Disable JScript in environments where it’s not required.
* For legacy systems:
* Isolate from internet access.
* Limit execution of IE-based content.
* Monitor endpoints for signs of unusual script behavior or process spawning.
---
### 🔐 Recommendations
1. Patch all affected systems immediately.
2. Audit use of Internet Explorer and legacy scripting engines.
3. Deploy endpoint protection with memory corruption detection.
4. Inform users about risks of visiting unknown websites.
5. If unable to patch, consider disabling or unregistering `jscript.dll`.
---
### 🔒 Disclaimer
This information is provided for **educational and defensive purposes only**. Unauthorized exploitation of vulnerabilities without proper authorization is **illegal and unethical**. Always conduct security testing in a **controlled environment** and with **explicit permission**. The responsibility for any misuse of this information lies solely with the user.
登录后查看神龙缓存的 POC 文件快照
登录查看