vendor:
ChakraCore
by:
Microsoft Security Response Center
7.8
CVSS
HIGH
Type Confusion
843
CWE
Product Name: ChakraCore
Affected Version From: ChakraCore 1.11.15.0
Affected Version To: ChakraCore 1.11.17.0
Patch Exists: YES
Related CWE: CVE-2020-17087
CPE: a:microsoft:chakracore:1.11.15.0
Other Scripts:
https://www.infosecmatter.com/nessus-plugin-library/?id=142680, https://www.infosecmatter.com/nessus-plugin-library/?id=142679, https://www.infosecmatter.com/nessus-plugin-library/?id=142686, https://www.infosecmatter.com/nessus-plugin-library/?id=142684, https://www.infosecmatter.com/nessus-plugin-library/?id=142693, https://www.infosecmatter.com/nessus-plugin-library/?id=142683, https://www.infosecmatter.com/nessus-plugin-library/?id=142690, https://www.infosecmatter.com/nessus-plugin-library/?id=142681, https://www.infosecmatter.com/nessus-plugin-library/?id=155351, https://www.infosecmatter.com/metasploit-module-library/?mm=exploit/multi/http/gitea_git_fetch_rce
Platforms Tested: Windows
2020
ChakraCore Type Confusion Vulnerability
The ChakraCore JavaScript engine is vulnerable to type confusion due to the lack of an ImplicitCallFlags check after the call to the EntrySimpleObjectSlotGetter method. This can lead to type confusion when the method wraps the return value using the CrossSite::MarshalVar method which traverses up the prototype chain of the given object using the GetPrototype method. If the getPrototypeOf handler of a Proxy object is changed, it can lead to type confusion.
Mitigation:
Microsoft has released a security update to address this vulnerability.
