Microsoft Edge Chakra - 'TryUndeleteProperty' Incorrect Usage (Denial of Service)

::NoSlots return false; propertyIndex = deletedPropertyIndex; deletedPropertyIndex = staticcastTaggedInt::ToInt32object-GetSlotdeletedPropertyIndex; return true; bool SimpleDictionaryUnorderedTypeHandle::TryUndeleteProperty DynamicObject const object, const TPropertyIndex existingPropertyIndex,...

Microsoft Edge: Out-of-bounds read in CInputDateTimeScrollerElement::_SelectValueInternal(CVE-2017-8644)

The vulnerability has been confirmed on Windows 10 Enterprise 64-bit OS version 1607, OS build 14393.1198 and Microsoft Edge 38.14393.1066.0, Microsoft EdgeHTML 14.14393. PoC: ========================================== input:focus transform: scale10; =========================================...

Microsoft Edge: Chakra: Type confusion in JavascriptArray::ConcatArgs(CVE-2017-8634)

Let's assume that the following method is called with "firstPromotedItemIsSpreadable = true", and "args" has two elements an array and an integer 0x1234 sequentially. In the first loop, "aItem" is an array, and "firstPromotedItemIsSpreadable" remains true because the condition for the fast path i...

Microsoft Edge Chakra - PreVisitCatch Missing Call

Microsoft Edge Chakra - PreVisitCatch Missing Call root-sxFnc.pnodeVars; pnode; pnode = pnode-sxVar.pnodeNext Symbol sym = pnode-sxVar.sym; if sym != nullptr && !pnode-sxVar.isBlockScopeFncDeclVar && sym-GetIsBlockVar if sym-GetIsCatch || pnode-nop == knopVarDecl && sym-GetIsBlockVar ... sym =...

Microsoft Edge Chakra - Uninitialized Arguments (2)

void Parser::ParseFncFormalsParseNodePtr pnodeFnc, ParseNodePtr pnodeParentFnc, ushort flags ... if IsES6DestructuringEnabled && IsPossiblePatternStart ... // Instead of passing the STFormal all the way on many methods, it seems it is better to change the symbol type afterward. for ParseNodePtr...

Microsoft Edge: Chakra: InterpreterStackFrame::ProcessLinkFailedAsmJsModule incorrectly re-parses(CVE-2017-8645)

When Chakra fails to link an asmjs module, it tries to re-parse the failed-to-link asmjs function to treat it as a normal javascript function. But it incorrectly handles the case where the function is a class. It starts to parse from the start of the class declaration instead of the constructor. ...

Microsoft Edge: Chakra: Uninitialized arguments 2(CVE-2017-8670)

Similar to the issue 1297 . But this time, it happends in "Parser::ParseFncFormals" with the "PNodeFlags::fpnArgumentsoverriddenInParam" flag. template void Parser::ParseFncFormalsParseNodePtr pnodeFnc, ParseNodePtr pnodeParentFnc, ushort flags ... if IsES6DestructuringEnabled &&...

Discourse: CSRF-tokens on pages without no-cache headers, resulting in ATO when using CloudFlare proxy (Web Cache Deception)

Hi, I noticed this issue on one of your clients which was using CloudFlare in front of their Discourse. This is not affecting try.discourse.org but the same underlying issue can be seen there as well even though it's not exploitable on that specific domain. The TL;DR of issue is basically:...

Microsoft Edge Chakra TryUndeleteProperty Incorrect Usage

Microsoft Edge: Chakra: Incorrect usage of TryUndeleteProperty CVE-2017-8635 Chakra implemented the reuse of deleted properties of an unordered dictionary object with the following code. bool SimpleDictionaryUnorderedTypeHandler::TryReuseDeletedPropertyIndex DynamicObject const object,...

Microsoft Edge Charka PreVisitCatch Missing Call

Microsoft Edge: Chakra: PreVisitCatch doesn't call SetIsCatch for all cases CVE-2017-8656 function trigger try catch x var x = 1; printx; trigger; When Chakra executes the above code, it declares two "x"s. One is only for the catch scope, the other is for the whole function scope. The one for the...

Microsoft Edge Chakra PushPopFrameHelper Incorrect Usage

Microsoft Edge: Chakra: Incorrect usage of PushPopFrameHelper in InterpreterStackFrame::ProcessLinkFailedAsmJsModule CVE-2017-8646 PushPopFrameHelper is a class that pushes the current stack frame object in its constructor and pops it in the destructor. So it should be used like "PushPopFrameHelp...

Legal Robot: Tampering the mail id on chatbox

hi sir , i found a vulnerability i.e tampering the data . steps to reproduce 1 login to https://app.legalrobot-uat.com 2 open https://app.legalrobot-uat.com/account 3 at right side bottom corner , there is a chat symbol. 4 just enter the message there , and capture the request using burpsuite and...

Microsoft Edge 38.14393.1066.0 - textarea.defaultValue Memory Disclosure

Microsoft Edge 38.14393.1066.0 - textarea.defaultValue Memory Disclosure var n = 0; function go document.addEventListener"DOMNodeRemoved", eventhandler; eventhandler; function eventhandler n++; ifn==5 return; //prevent going into an infinite recursion t.defaultValue = "aaaaaaaaaaaaaaaaaaaa";...

DALIM SOFTWARE ES Core 5.0 build 7184.1 - Directory Traversal

DALIM SOFTWARE ES Core 5.0 build 7184.1 Multiple Remote File Disclosures Vendor: Dalim Software GmbH Product web page: https://www.dalim.com Affected version: ES/ESPRiT 5.0 build 7184.1 build 7163.2 build 7163.0 build 7135.0 build 7114.1 build 7114.0 build 7093.1 build 7093.0 build 7072.0 build...

Slack: The Custom Emoji Page has a Reflected XSS

The Custom Emoji Page has a Reflected XSS in building flash message. The following is the PoC. https://team.slack.com/customize/emoji?added=1&name=vuln"alert0;...

NoMachine 5.3.9 - Local Privilege Escalation

NoMachine 5.3.9 - Local Privilege Escalation """ Exploit Title: NoMachine LPE - Local Privilege Escalation Date: 09/08/2017 Exploit Author: Daniele Linguaglossa Vendor Homepage: https://www.nomachine.com Software Link: https://www.nomachine.com Version: 5.3.9 Tested on: OSX CVE : CVE-2017-12763...

“The seismic network of the third generation”CVE-2017-8464 vulnerability analysis and early warning-vulnerability warning-the black bar safety net

Microsoft in the 2017 year 6 month patch patch a shortcut CVE-2107-8464 of vulnerability, the announcement says this vulnerability is the National background of network attacks the use to implement the attack, the vulnerability is also known as the seismic network of the third generation, recentl...

Tor: languagechange event fires simultaneously on all tabs

The languagechange event, which fires when the user modifies the browser's language settings fires simultaneously on all tabs. This would allow an adversary to link multiple visits to a single user: the adversary e.g. a malicious ad provider has a script that listens for this event, and when fire...

SecuriTeam Secure Disclosure

Hi all, In the past 10 years Beyond Security runs a vulnerability disclosure program called SecurTeam Secure Disclosure SSD. We are looking to acquire high end vulnerabilities in various stages of research, PoC and similar. We also runs Hack2Win online competition. Hack2Win online is a hacking...

SMBLoris Denial Of Service

There's a lot of talk about SMBLoris but nobody seems to have written a public efficient PoC yet, so I gave it a shot. A single instance takes down a fully patched Windows 10 Pro box with 8GiB of RAM in less than 10 seconds. I tried using Scapy initially, but it's dog slow, so I went with C. The...