VULHUB ™

内容来源:https://bugs.chromium.org/p/project-zero/issues/detail?id=1043 I noticed that some javascript getters behave strangely. My test code: ``` var whitelist = ["closed", "document", "frames", "length", "location", "opener", "parent", "self", "top", "window"]; var f = document.createElement("iframe"); f.onload = () => { f.onload = null; for (var x in window) { if (whitelist.indexOf(x) != -1) continue; try { window.__lookupGetter__(x).call(f.contentWindow); log(x); } catch (e) { } } }; f.src = "https://abc.xyz/"; document.body.appendChild(f); ``` And after some plays, finally reached an UAF condition. PoC is attached. RIP will jump into the freed JIT code. Tested on Microsoft Edge 38.14393.0.0.

内容来源:https://bugs.chromium.org/p/project-zero/issues/detail?id=1043 I noticed that some javascript getters behave strangely. My test code: ``` var whitelist = ["closed", "document", "frames", "length", "location", "opener", "parent", "self", "top", "window"]; var f = document.createElement("iframe"); f.onload = () => { f.onload = null; for (var x in window) { if (whitelist.indexOf(x) != -1) continue; try { window.__lookupGetter__(x).call(f.contentWindow); log(x); } catch (e) { } } }; f.src = "https://abc.xyz/"; document.body.appendChild(f); ``` And after some plays, finally reached an UAF condition. PoC is attached. RIP will jump into the freed JIT code. Tested on Microsoft Edge 38.14393.0.0.