CVE-2024-9680

Classification basis

The artifact is classified as an exploit because it contains complete, functional code designed to trigger a vulnerability (CVE-2024-9680) and achieve remote code execution. The code includes shellcode, heap spraying, ROP chain construction, and a use-after-free trigger. The README and HTML files explicitly state it is an 'exploit' and a 'PoC', and the code performs all steps necessary for exploitation, not just detection.

Requirements

• Victim must use a vulnerable version of Firefox (e.g., < 131.0.2) or Tor Browser.README.md:27-29
• The exploit targets Windows x86 systems, as indicated by the shellcode and ROP chain construction.exploit/cssbanner.js:56-106exploit/index.html:269

Observed behavior

• The exploit delivers encoded shellcode to a Web Worker for execution.exploit/index.html:97-106
• It performs heap spraying by creating many ArrayBuffer objects to control memory layout.exploit/index.html:112-115exploit/index.html:140-159
• It crafts a complex SVG DOM structure with circular animation timing references to set up the use-after-free condition.exploit/index.html:194-229
• The use-after-free is triggered by calling pauseAnimations() after manipulating animation attributes, leading to memory corruption and code execution.exploit/index.html:149-169
• The Web Worker (cssbanner.js) constructs a ROP chain and resolves Windows API functions (e.g., VirtualAlloc, CreateThread) to execute the shellcode.exploit/cssbanner.js:107-156exploit/cssbanner.js:267-284
• After exploitation, the original exploit redirects the browser to 'payload withheld' for a secondary payload.exploit/original.html:159

Flagged behaviors

Observables

Shellcode

Payload withheldThe shellcode is delivered to a Web Worker and is part of the exploit chain for remote code execution.exploit/index.html:97-101

Url

Payload withheldThe original.html file redirects the browser to 'payload withheld' after 2 seconds, which is a post-exploitation behavior.exploit/original.html:159