Vulnerability record · CVE-2004-0549 · published 6 August 2004
CVE-2004-0549: Internet Explorer MSHTML showModalDialog Remote Code Execution
Microsoft · Internet Explorer
Internet Explorer 6's WebBrowser ActiveX control and MSHTML rendering engine allow remote code execution in the Local Security context via the showModalDialog method combined with location modification. Attackers can trigger this through delayed HTTP redirects with a crafted Location header or by modifying the window.location attribute, as seen in the Download.ject (Scob/Toofer) exploit using ADODB.Stream. This is a critical flaw because it enables arbitrary code execution with no authentication or user interaction beyond visiting a malicious page.
Description
The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to execute arbitrary code in the Local Security context by using the showModalDialog method and modifying the location to execute code such as Javascript, as demonstrated using (1) delayed HTTP redirect operations, and an HTTP response with a Location: header containing a "URL:" prepended to a "ms-its" protocol URI, or (2) modifying the location attribute of the window, as exploited by the Download.ject (aka Scob aka Toofer) using the ADODB.Stream object.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityCVSS 2.0 score of 10.0 with network exploitable, no authentication, complete confidentiality, integrity, and availability impact, plus confirmed in-the-wild exploitation by Download.ject.
What it is
Internet Explorer 6's WebBrowser ActiveX control and MSHTML rendering engine allow remote code execution in the Local Security context via the showModalDialog method combined with location modification. Attackers can trigger this through delayed HTTP redirects with a crafted Location header or by modifying the window.location attribute, as seen in the Download.ject (Scob/Toofer) exploit using ADODB.Stream. This is a critical flaw because it enables arbitrary code execution with no authentication or user interaction beyond visiting a malicious page.
Impact
An attacker can execute arbitrary code in the Local Security context, effectively gaining the same privileges as the logged-on user. This allows full system compromise, including data theft, installation of malware, and lateral movement.
Attack surface
The vulnerability is reached remotely over the network via a malicious web page or HTTP response. No authentication is required, and the CVSS vector indicates no user interaction (AV:N/AC:L/Au:N), though in practice a user must visit the page or be redirected to it.
Exploitation
The record does not list this CVE in CISA KEV, but EPSS is 0.61057 (99.1st percentile), indicating high likelihood of exploitation. References include US-CERT alerts and a Microsoft security bulletin, and the description explicitly mentions exploitation by Download.ject, confirming active exploitation in the wild.
What to do
- Apply the patch referenced in Microsoft Security Bulletin MS04-025 (US-CERT TA04-163A).
- Disable or restrict the WebBrowser ActiveX control and MSHTML rendering in Internet Explorer via kill bits or group policy.
- Upgrade to a supported, modern browser that does not use the vulnerable MSHTML engine.
- Block or filter HTTP responses with suspicious Location headers containing 'URL:' prepended to 'ms-its' protocol URIs.
- Enforce network-level controls to prevent access to known malicious domains associated with Download.ject.
Detection
- Monitor for HTTP responses with Location headers containing 'URL:ms-its' or similar protocol manipulation.
- Detect processes spawning from Internet Explorer or MSHTML that execute unexpected child processes or write to system directories.
- Hunt for ADODB.Stream object creation or usage in browser processes via script block logging or EDR telemetry.
- Review proxy or IDS logs for delayed redirects or showModalDialog abuse patterns.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2004-0549 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2004-0549), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
