PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Escaping JavaScript sandboxes with parsing issues

portswigger.net | research | #fuzzing | #web-security | #sandbox-escape | #safari | #unicode-escapes | #javascriptcore
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Fuzzing JavaScriptCore uncovered 721,520 inconsistently parsed Unicode escapes in Safari, where typeof\u{10ffdc} splits across parser paths — a class of issues that can escape JS sandboxes.
Published
Collected

Related coverage

blog · projectzero.google
An analysis of an in-the-wild iOS Safari WebContent to GPU Process exploit
A step-by-step analysis of an in-the-wild iOS exploit that escapes Safari's WebContent process into the GPU process, covering the underlying bug and exploitation strategy.
blog · projectzero.google
pwn4fun Spring 2014 - Safari - Part II
Part two of a Google Project Zero pwn4fun series, detailing how a Safari compromise escalated from the renderer sandbox to full system access on OS X.
blog · projectzero.google
pwn4fun Spring 2014 - Safari - Part I
Part one of a Google Project Zero pwn4fun series, detailing how a bug in Safari's JavaScriptCore engine yielded code execution inside the renderer sandbox.
research · portswigger.net
onwebkitplaybacktargetavailabilitychanged?! New exotic events in the XSS cheat sheet
The XSS cheat sheet adds exotic event vectors: Safari-only onwebkitplaybacktargetavailabilitychanged for audio/video, heavy-interaction onpointercancel and the widely usable autofocus attribute.
research · portswigger.net
Safari is hot-linking images to semi-random websites
Safari's over-enthusiastic OCR parses text inside images into clickable links — the Amazon logo's arrow produced 'Zon.com'; the research probes which URL formats and payloads Safari will accept.
research · portswigger.net
Hiding payloads in Java source code strings
Java processes unicode escapes in string literals before parsing, so \u0022 can close a string and run code — Bambdas from untrusted sources can achieve RCE and must be validated first.
Back