Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

FF Sandbox Escape (CVE-2020-12388)

projectzero.google | vulnerability | CVE-2020-12388 | #rce | #firefox | #sandbox-escape | #windows | #cve | #project-zero

Summary

By James Forshaw, Project Zero In my previous blog post I discussed an issue with the Windows Kernel’s handling of Restricted Tokens which allowed me to escape the Chrome GPU sandbox. Originally I’d planned to use Firefox for the proof-of-concept as Firefox uses the same effective sandbox level as the Chrome GPU process for its content renderers. That means a FF content RCE would give code execution in a sandbox where you could abuse the Windows Kernel Restricted Tokens issue, making it much more serious.
CVE
CVE-2020-12388
Published
Collected

original ↗

Related coverage

vulnerability · projectzero.google
Internet Explorer EPM Sandbox Escape CVE-2014-6350
A Google Project Zero post detailing exploitation of CVE-2014-6350 to escape Internet Explorer's Enhanced Protected Mode sandbox.
blog · projectzero.google
In-Console-Able
A Google Project Zero post describing a Windows security bug that weakens sandbox-style restrictions and could aid sandbox escape research.
vulnerability · projectzero.google
[CVE-2015-4481] Between a Rock and a Hard Link
Hard links are legal inside Windows sandboxes, making them a useful exploitation primitive; the post weighs their pros and cons and demonstrates them in the real vulnerability CVE-2015-4481.
High · vulnerability · github.com
WordPress Core Unauthenticated Path Traversal to LFI & RCE PoC (CVE-2026-87902)
While remote code execution depends on runtime prerequisites like PEAR, the unauthenticated LFI primitive resides directly in WordPress Core and affects all major branches from 4.7.0 through 7.1.1.
vulnerability · projectdiscovery.io
Supply Chain Security Analysis of a 9.5M-Install VS Code Extension
Your code editor extensions auto-update and run with your privileges on the machine that holds your source code, your SSH keys, and your publishing credentials, but they rarely show up in a software bill of materials. Using Neo we audited one of the most popular ones, Markdown Preview Enhanced has roughly 9.5 million installs. The neo found five CVEs across two attack surfaces. A WaveDrom rendering bug turned an ordinary Markdown file into JavaScript execution inside the preview, then into arb
blog · projectzero.google
aPAColypse now: Exploiting Windows 10 in a Local Network with WPAD/PAC and JScript
A Project Zero write-up showing how a local network attacker can abuse Windows 10 WPAD/PAC proxy files, executed as JavaScript by jscript.dll, to achieve remote code execution.
back