Apr 15, 2023 05:38 PM
(This post was last modified: Apr 20, 2023 10:07 PM by Mr. Robot.)
CVE-2023-2033
Already seen people tryna execute this in the wild.
Edge and Chrome users beware - I think it can also be popped via discord in browser.
Long story short all that has been disclosed:
"A remote attacker could exploit this Chrome V8 type confusion vulnerability to cause heap corruption via a crafted HTML page"
Based on that information we can tell that it's to do with the way JavaScript code is executed. This is common in things like Node.js, but due to the way the Chrome V8 JavaScript engine is used, it affected other browsers too such as Brave and Opera.
What we know so far is that it might have been able to affect Discord as well based on the dependencies, however this is unknown at this time due to the way it displays data.
What this exploit takes advantage of is a "type confusion" which is when the javascript engine incorrectly associates the type of an object or code in memory such as an integer or string. Because of how JavaScript works and the fact it's a dynamically typed language, variables can change type WHILE being executed but while they change type, at run time the engine needs to keep track of which type is which.
This allows more control over the memory of the javascript engine - if you can make the engine during run time execute extra data in memory, in this case making it think it's running one type such as an integer vs a string, it would perform incorrect operations on the output object or what is displayed/run in the browsers end.
Example javascript of an integer and a string
From here you can leverage the object left in memory and store objects leading to a heap corruption. From a heap corruption you can possible expose information or cause arbitrary code execution.
A heap corruption in short is when there is a memory issue on a website and the heap which is a locally stored area on your machine for your browser is used for storing information during runtime is caused to run outside that allocated space, giving access to areas that are persistent and not deleted after runtime.
Using this information we can see that an attacker would make the HTML page containing javascript code that triggers the type confusion, specifically targeting the V8 engine. Anyone who visits the website would have their browsers memory heap corrupted which could then lead toe code execution or exposure of local files/data.
TLDR:
1. You have a heap file/location that is edited during runtime. It's unloaded and loaded when your browser is open/when the javascript is running on a site.
2. A malicious website can take advantage of that by causing an error in the way javascript is run, meaning that heap location 'falls apart' and extra code is placed outside of it for persistence.
3. That code outside of the heap is no longer 'sandboxed' the same way which can lead to information being sent back to the user/code being executed.
Already seen people tryna execute this in the wild.
Edge and Chrome users beware - I think it can also be popped via discord in browser.
Long story short all that has been disclosed:
"A remote attacker could exploit this Chrome V8 type confusion vulnerability to cause heap corruption via a crafted HTML page"
Based on that information we can tell that it's to do with the way JavaScript code is executed. This is common in things like Node.js, but due to the way the Chrome V8 JavaScript engine is used, it affected other browsers too such as Brave and Opera.
What we know so far is that it might have been able to affect Discord as well based on the dependencies, however this is unknown at this time due to the way it displays data.
What this exploit takes advantage of is a "type confusion" which is when the javascript engine incorrectly associates the type of an object or code in memory such as an integer or string. Because of how JavaScript works and the fact it's a dynamically typed language, variables can change type WHILE being executed but while they change type, at run time the engine needs to keep track of which type is which.
This allows more control over the memory of the javascript engine - if you can make the engine during run time execute extra data in memory, in this case making it think it's running one type such as an integer vs a string, it would perform incorrect operations on the output object or what is displayed/run in the browsers end.
Example javascript of an integer and a string
Code
// Integer example
let integerExample = 123;
// String example
let stringExample = "This is a string";From here you can leverage the object left in memory and store objects leading to a heap corruption. From a heap corruption you can possible expose information or cause arbitrary code execution.
A heap corruption in short is when there is a memory issue on a website and the heap which is a locally stored area on your machine for your browser is used for storing information during runtime is caused to run outside that allocated space, giving access to areas that are persistent and not deleted after runtime.
Using this information we can see that an attacker would make the HTML page containing javascript code that triggers the type confusion, specifically targeting the V8 engine. Anyone who visits the website would have their browsers memory heap corrupted which could then lead toe code execution or exposure of local files/data.
TLDR:
1. You have a heap file/location that is edited during runtime. It's unloaded and loaded when your browser is open/when the javascript is running on a site.
2. A malicious website can take advantage of that by causing an error in the way javascript is run, meaning that heap location 'falls apart' and extra code is placed outside of it for persistence.
3. That code outside of the heap is no longer 'sandboxed' the same way which can lead to information being sent back to the user/code being executed.
![[Image: Radioactive-hack.png]](https://i.ibb.co/5XsDcGSC/Radioactive-hack.png)
![[Image: kfdw1k1.png]](https://i.imgur.com/kfdw1k1.png)
![[Image: New-Signature-v2.png]](https://i.ibb.co/FLQmYqVX/New-Signature-v2.png)