CVE-2019-0539
HIGHChakraCore - Remote Code Execution via Memory Corruption
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2019-0539. PoCs published by Google Security Research, Fahad Aid Alharbi, 0x43434343.
AI-analyzed exploit summary This PoC demonstrates a type confusion vulnerability in JavaScript engines by exploiting the side effects of NewScObjectNoCtor and InitProto opcodes, leading to memory corruption. It overwrites property slots with an arbitrary value (0x1234) to trigger the issue.
Description
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0567, CVE-2019-0568.
Exploits (4)
This PoC demonstrates a type confusion vulnerability in JavaScript engines by exploiting the side effects of NewScObjectNoCtor and InitProto opcodes, leading to memory corruption. It overwrites property slots with an arbitrary value (0x1234) to trigger the issue.
This PoC exploits a prototype pollution vulnerability in JavaScript engines by manipulating object prototypes through the InitClass instruction and SetIsPrototype method. It demonstrates arbitrary property manipulation, which can lead to type confusion or RCE in affected engines.
This exploit leverages a type confusion vulnerability in Chakra (CVE-2019-0539) to achieve arbitrary read access in memory. It manipulates object properties and ArrayBuffer handling to bypass security checks and leak memory addresses.
This is a working exploit PoC for CVE-2019-0539, a type confusion vulnerability in ChakraCore. The exploit leverages JavaScript type confusion to achieve arbitrary read/write primitives and constructs a ROP chain for potential code execution.
References (5)
Scores
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H