seregonwar
Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
GitHubseregonwar/uaf-2023-28205
Repository PoCStars: 8Created 2026-01-04ExploitCVE-2023-2820513 files
Analysis
Technical assessment
The artifact is a JavaScript exploit for CVE-2023-28205, a use-after-free vulnerability in Apple WebKit. It triggers the vulnerability by sending a crafted object graph via postMessage, forcing garbage collection during deserialization to create a dangling pointer, and then attempts to verify memory corruption through heap spraying and identity checks.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README describing a CVE-2023-28205 WebKit use-after-free vulnerability and a JavaScript PoC (poc.js) that triggers the vulnerability. The PoC code performs standard exploit-development actions: creating object structures, sending them via postMessage, forcing garbage collection, and probing for memory corruption. No concealed executable behavior, unrelated remote access, credential theft, persistence, or operator-directed harm is present. The code logs diagnostic information to localStorage and the console, which is consistent with a research PoC.
Classification basis and observed behavior
Classification basis
The code actively triggers a use-after-free vulnerability and includes logic to verify memory corruption, which is characteristic of an exploit. The README describes it as a proof of concept that triggers a UAF, and the JavaScript code implements the full trigger and post-exploitation verification steps.
README.md:14-20poc.js:188-320Requirements
- Victim must process maliciously crafted web content (e.g., visit a page hosting the exploit).
README.md:3-5 - Target must be a vulnerable version of WebKit (e.g., Safari < 16.4.1, iOS < 16.4.1).
README.md:7-8
Observed behavior
- Sends a deeply nested object graph containing Map and Date objects via postMessage to trigger recursive deserialization.
poc.js:168-186poc.js:219 - Forces garbage collection during deserialization to free objects still referenced by non-GC-scanned containers.
poc.js:223README.md:14-20 - Detects the use-after-free by observing a confused object (a Date with a specific marker) in the deserialized data.
poc.js:228-244 - In non-crash mode, performs heap spraying with replacement objects and verifies memory reuse by checking identity or property markers.
poc.js:255-312
Behaviors behind the backdoor verdict
Observables
- LocalStorage Logging
- Payload withheldThe PoC persists diagnostic logs to localStorage under a fixed key, which is normal for a browser-based exploit PoC and does not constitute exfiltration or backdoor behavior.
poc.js:16-55 - Url Parameter Reading
- Payload withheldThe PoC reads 'mode' and 'probe' from the URL query string to control behavior (crash vs. probe), which is typical for a configurable PoC and does not indicate hidden command-and-control.
poc.js:6-14poc.js:64-75
What the analysis did not establish
- Only two of thirteen repository files were provided as text; the remaining eleven files are unclassified and may contain additional exploit logic or dependencies.
- The evidence does not include the imported modules (e.g., utils.mjs, int64.mjs, mem.mjs), which may be required for full exploit functionality.
- The analysis is based solely on static review of the provided source code; the code was not executed, and its reliability or effectiveness is not verified.
- Only two of 13 repository files were provided as text; 11 files were omitted from the evidence packet. The omitted files are reported as unclassified and may contain additional content not reviewed.
- Binary files were flagged but not analyzed; the evidence packet reports zero binary files, so this limitation is noted for completeness but does not affect the current review.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.