CVE-2024-8381

CRITICAL

Firefox < 130 and Firefox ESR < 115.15 - Type Confusion via 'with' Environment Property Lookup

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-8381. PoCs published by bjrjk.

AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2024-8381, a SpiderMonkey interpreter type confusion vulnerability. The exploit demonstrates memory corruption leading to arbitrary code execution via a crafted JavaScript object and type confusion.

Description

A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.

Exploits (1)

nomisec WORKING POC 15 stars

by bjrjk · poc

https://github.com/bjrjk/CVE-2024-8381

View Code ZIP pw:eip

This repository contains a proof-of-concept exploit for CVE-2024-8381, a SpiderMonkey interpreter type confusion vulnerability. The exploit demonstrates memory corruption leading to arbitrary code execution via a crafted JavaScript object and type confusion.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Complex

Reliability

Reliable

Target: Mozilla SpiderMonkey (Firefox JavaScript engine)

No auth needed

Prerequisites: ASLR disabled · Specific SpiderMonkey build (commit 198d5fc1bebaaf114197a529ebdd4b9601045719)

MITRE ATT&CK