module

Safari Proxy Object Type Confusion

Try Surface Command
Back to search
Disclosed
Mar 15, 2018
Created
Mar 19, 2019

Description

This module exploits a type confusion bug in the Javascript Proxy object in
WebKit. The DFG JIT does not take into account that, through the use of a Proxy,
it is possible to run arbitrary JS code during the execution of a CreateThis
operation. This makes it possible to change the structure of e.g. an argument
without causing a bailout, leading to a type confusion (CVE-2018-4233).

The JIT region is then replaced with shellcode which loads the second stage.
The second stage exploits a logic error in libxpc, which uses command execution
via the launchd's "spawn_via_launchd" API (CVE-2018-4404).

Author

saelo

Platform

OSX,Python,Unix

Architectures

python, cmd

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/osx/browser/safari_proxy_object_type_confusion
    msf exploit(safari_proxy_object_type_confusion) > show targets
        ...targets...
    msf exploit(safari_proxy_object_type_confusion) > set TARGET < target-id >
    msf exploit(safari_proxy_object_type_confusion) > show options
        ...show and set options...
    msf exploit(safari_proxy_object_type_confusion) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today