How to remediate – Windows AutoRuns JavaScript MSHTML

1. Introduction

The Windows AutoRuns JavaScript MSHTML vulnerability reports when JavaScript is running on system startup via registry autorun keys. This technique isn’t typical in standard software, but malware uses it for persistence without creating files on disk. Detecting this doesn’t automatically mean a system is infected, but requires investigation by an administrator. Impact to confidentiality, integrity and availability depends on the script being run; potentially high if malicious.

2. Technical Explanation

• Root cause: JavaScript code is allowed to run from registry autorun locations.
• Exploit mechanism: An attacker adds a registry key that executes JavaScript during startup using MSHTML. For example, they could modify the HKCUSoftwareMicrosoftWindowsCurrentVersionRun key with a value pointing to a malicious script executed via wscript.exe or cscript.exe.
• Scope: Windows systems are affected. The specific registry keys involved include those under HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun, HKCUSoftwareMicrosoftWindowsCurrentVersionRun and others used for auto-start.

3. Detection and Assessment

Confirming a vulnerable system involves checking the registry for JavaScript autorun entries. A quick check can identify running scripts; thorough assessment requires examining all relevant registry keys.

• Quick checks: Use PowerShell to list startup programs: Get-WmiObject -Class Win32_StartupCommand | Where-Object {$_.Name -like "*script*"}
• Scanning: Nessus vulnerability ID 37e3a88e and 6738698f can detect this issue. These are examples only, results may vary depending on scanner configuration.
• Logs and evidence: Check the Windows Event Logs for events related to wscript.exe or cscript.exe execution during startup (Event IDs may include 4688 – Process Creation).

Get-WmiObject -Class Win32_StartupCommand | Where-Object {$_.Name -like "*script*"}

4. Solution / Remediation Steps

Fixing this issue involves identifying and removing the malicious registry entries. Take care when modifying the registry.

4.1 Preparation

• No services need to be stopped, but close any running scripts that might interfere with the process. A roll back plan is to restore from backup or system restore point.
• Changes should be made during a maintenance window and approved by a senior administrator.

4.2 Implementation

1. Step 1: Open Registry Editor (regedit.exe).
2. Step 2: Navigate to HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun and check for entries referencing JavaScript files or scripts.
3. Step 3: If found, delete the suspicious entry.
4. Step 4: Repeat Step 2 & 3 for HKCUSoftwareMicrosoftWindowsCurrentVersionRun and other auto-start registry keys.

4.3 Config or Code Example

Before

"MaliciousScript"="wscript.exe C:UsersuserAppDataRoamingmalware.js"

After

(Entry removed)

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this type of issue.

• Practice 1: Least privilege reduces the impact if a script is executed with elevated permissions.
• Practice 2: Regularly review startup programs and registry entries for unexpected or unknown items.

4.5 Automation (Optional)

A PowerShell script can automate the removal of suspicious entries, but use caution.

# Caution: This script deletes registry keys - test thoroughly!
Get-WmiObject -Class Win32_StartupCommand | Where-Object {$_.Name -like "*script*"} | ForEach-Object {
  Remove-ItemProperty -Path "HKCU:SoftwareMicrosoftWindowsCurrentVersionRun" -Name $_.Name -Force
}

5. Verification / Validation

Confirm the fix by checking that the registry entries have been removed and re-running the initial detection methods.

• Post-fix check: Run Get-WmiObject -Class Win32_StartupCommand | Where-Object {$_.Name -like "*script*"}. Expected output should be empty or not contain suspicious entries.
• Re-test: Re-run the initial scan using Nessus vulnerability IDs 37e3a88e and 6738698f to confirm no detections.
• Smoke test: Verify that essential system functions (login, desktop loading) work as expected.
• Monitoring: Monitor Windows Event Logs for unexpected execution of wscript.exe or cscript.exe.

Get-WmiObject -Class Win32_StartupCommand | Where-Object {$_.Name -like "*script*"}

6. Preventive Measures and Monitoring

Several measures can help prevent this vulnerability.

• Baselines: Update security baselines to include restrictions on JavaScript execution from startup locations, such as through Group Policy or Intune settings.
• Pipelines: Implement application control solutions that block unauthorized scripts and programs.
• Asset and patch process: Review system configurations regularly for unexpected changes.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Removing a valid startup entry may prevent an application from launching correctly.
• Risk or side effect 2: Incorrectly modifying the registry can lead to system instability.
• Roll back: Restore the Windows Registry from backup or use System Restore to revert to the previous state.

8. References and Resources

Links to resources related to this vulnerability.

• Vendor advisory or bulletin: http://www.nessus.org/u?37e3a88e
• NVD or CVE entry: No specific CVE is associated with this detection.
• Product or platform documentation relevant to the fix: http://www.nessus.org/u?6738698f