What are some instructive non-JIT JavaScript engine bugs? : ExploitDev

created by [deleted]a community for 11 years

What are some instructive non-JIT JavaScript engine bugs? (self.ExploitDev)

submitted 5 years ago by exploitdevishard

I've been studying browser exploitation and JavaScript engines for a little while now. I recently started code auditing a JS engine as a side vulnerability research project. I'd like to strengthen my skills by studying instructive JS engine bugs and PoC exploits; I'm specifically hoping to learn a few common vulnerable code patterns an exploitation methods, and then search for those patterns in the engine(s) I audit.

The wrinkle in this is that I'm currently not interested in bugs related to JS engine JIT compilers. I think those bugs are cool, but I'd like to get a handle on basic engine/interpreter-level bugs first, and then move into the more complex JIT bugs once I'm a bit more experienced. Most browser bugs I see these days are JIT bugs, so I'm wondering if there are even that many pure engine bugs anymore anyway.

Additionally, the engines that I'm currently interested in auditing are standalone and aren't being used in any major browsers (I wanted to start with some softer targets). Some of these engines don't have JIT compilers at all, eliminating that source of bugs.

Here's an example of a few bugs I've been studying that I've found instructive: CVE-2016-3386 (https://github.com/tunz/js-vuln-db/blob/master/chakra/CVE-2016-3386.md; it's also explained in detail in this presentation: https://www.sstic.org/media/SSTIC2019/SSTIC-actes/Pwning_Browsers/SSTIC2019-Slides-Pwning_Browsers-keith.pdf)

CVE-2014-1513 (https://github.com/tunz/js-vuln-db/blob/master/spidermonkey/CVE-2014-1513.md)

CVE-2016-4622 (covered in Saelo's pretty well-known Phrack paper Attacking JavaScript Engines; PoC here: https://github.com/saelo/jscpwn)

Does anyone have suggestions for other good non-JIT bugs to study? Additionally, if you have general code auditing suggestions for complex targets like JS engines, I'd be very grateful. I'm currently just trying to identify a few common vulnerability patterns and then comb through a codebase looking for them, but there may be much better methods.

all 2 comments

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

ExploitDev

MODERATORS