Chakra is vulnerable to a type confusion vulnerability in the ArgumentReader::AdjustArguments() function. This vulnerability can be exploited by using a Proxy object to call the Function.prototype.call method with a null value as the first argument. This causes the value of args.Info.Count to become 0, which can lead to a type confusion vulnerability.
The vulnerability is a type confusion bug in the JavaScript engine. The PoC code creates an array 'a' with two elements and an array 'b' with 0 elements. The function 'func' takes the two arrays as parameters and assigns the first element of 'a' to 1.2, the first element of 'b' to the value of 'c', the second element of 'a' to 2.2 and the first element of 'a' to 2.3023e-320. The 'main' function then creates an array 'a' with two elements and an array 'b' with 0 elements. It then forces the engine to optimize the code by looping through 0x10000 iterations of the 'func' function. Finally, it calls the 'func' function with an object as the third parameter, which sets the first element of 'a' to an empty object. When the 'toString' method of the empty object is called, a type confusion occurs.
The vulnerability occurs when the “EmitAssignment” function does not call the “EmitSuperMethodBegin” function which initializes the “this” register for the case when the super keyword is used. This can lead to an uninitialized “this” register which can be exploited by an attacker to gain access to sensitive information or execute malicious code.
Chakra, the JavaScript engine used in Microsoft Edge, implemented the reuse of deleted properties of an unordered dictionary object. The code for this implementation was found in the TryReuseDeletedPropertyIndex and TryUndeleteProperty functions. The TryUndeleteProperty function was called from the SetPropertyFromDescriptor function, which was used to set properties on the object. If the property was marked as deleted, the function would attempt to reuse the deleted property index. If the property was not an internal property, the function would fail and the property would not be set. This could lead to a denial of service attack, as the property would not be set and the application would not function as expected.
PushPopFrameHelper is a class that pushes the current stack frame object in its constructor and pops it in the destructor. However, InterpreterStackFrame::ProcessLinkFailedAsmJsModule uses it like a function, pushing and immediately popping the 'newInstance' object. This can lead to a Use-After-Free vulnerability, as demonstrated in the provided proof-of-concept code. The PoC will crash in the following code: Js::InterpreterStackFrame * interpreterFrame = executeFunction->GetScriptContext()->GetThreadContext()->GetLeafInterpreterFrame(); <<-- Invalid stack frame object loopHeader = executeFunction->GetLoopHeader(interpreterFrame->GetCurrentLoopNum()); <<-- interpreterFrame->GetCurrentLoopNum() == -1
When Chakra fails to link an asmjs module, it tries to re-parse the failed-to-link asmjs function to treat it as a normal javascript function. But it incorrectly handles the case where the function is a class. It starts to parse from the start of the class declaration instead of the constructor. So it may result in binding incorrect information to the constructor.
This vulnerability is a heap based overflow in ChakraCore, a JavaScript engine developed by Microsoft. The vulnerability exists in the InterpreterStackFrame::InterpreterHelper function in the lib/Runtime/Language/InterpreterStackFrame.cpp file. The vulnerability is triggered when the number of local variables exceeds the InterpreterStackFrame::LocalsThreshold limit. This causes the buffer to be allocated on the heap instead of the stack, which can lead to a heap based overflow.
A stack overflow vulnerability exists in the ChakraCore-master library in the ByteCodeEmitter.cpp file. The vulnerability is caused by a lack of proper bounds checking when handling arguments for a call. This can be exploited by an attacker to cause a null pointer dereference and potentially execute arbitrary code.
The vulnerability allows an attacker to inject sql commands, access the administration panel and upload arbitrary file.
The vulnerability allows an attacker to inject sql commands, access the normal member and administration panel, and upload arbitrary file.
Services By CQR