Jump to content
Sign in to follow this  
Nytro

CVE-2020-0674 is a use-after-free vulnerability in the legacy jscript engine

Recommended Posts

CVE-2020-0674

CVE-2020-0674 is a use-after-free vulnerability in the legacy jscript engine. It can be triggered in Internet Explorer. The exploit here is written by maxpl0it but the vulnerability itself was discovered by Qihoo 360 being used in the wild. This exploit simply pops calc.

Exploit writeup coming soon.

Vulnerability Overview

  • The vulnerability exists in the Array sort function when using a comparator function.
  • The two supplied arguments for the comparator function are not tracked by the Garbage Collector and thus will point to freed memory after the GC is called.

Exploit Notes

  • The exploit was written for Windows 7 specifically, but could probably be ported without too much hassle.
  • This exploit was written for x64 instances of IE, therefore will run on (and has been tested on) the following browser configurations:
    • IE 8 (x64 build)
    • IE 9 (x64 build)
    • IE 10 (Either with Enhanced Protected Mode enabled or TabProcGrowth enabled)
    • IE 11 (Either with Enhanced Protected Mode enabled or TabProcGrowth enabled)
  • It's worth noting that Enhanced Protected Mode on Windows 7 simply enables the x64 version of the browser process so it's not a sandbox escape so much as there not being any additional sandbox. Ironically since this exploit is for x64, EPM actually allows it to work.
  • The exploit isn't made to entirely bypass EMET (Only a stack pivot detection bypass has really been implemented), however the final version (5.52) doesn't seem to trigger EAF+ when the exploit is run whereas 5.5 does (at least, on Windows 7 x64). So IE 11 in Enhanced Protected Mode with maximum EMET settings enabled allows the exploit.
  • The exploit is heavily commented but in order to get a better understanding of how the exploit works and what it's doing at each stage, change var debug = false; to var debug = true; and either open the developer console to view the log or keep it closed and view the alert popups instead (which might be a little annoying).

 

Sursa: https://github.com/maxpl0it/CVE-2020-0674-Exploit

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this  

×
×
  • Create New...