Add reference to Domsson's fakesteak and minor tweaks to articles.minimalist

1 files changed, 16 insertions, 16 deletions

diff --git a/_log/jint-gadget-chain-rce.md b/_log/jint-gadget-chain-rce.md
index 081ec0e..4241419 100644
--- a/_log/jint-gadget-chain-rce.md
+++ b/_log/jint-gadget-chain-rce.md
@@ -4,25 +4,25 @@ date: 2026-07-18
 layout: post
 ---
 
-Asyx6, a bounty hunter, reported a CVSS 9.9 RCE vulnerability in a six-year-old
-program.
+Received a CVSS 9.9 RCE vulnerability report from security researcher asyx6
+today.
 
-The application exposed JSON data from HTTP requests to Jint as
-JObjects—presumed safe because the CLR interop was disabled in the Jint
-configuration.  It wasn't.
+Six-year-old program exposed JSON data from HTTP requests to Jint as
+JObjects—presumed safe because CLR interop was disabled. Jint uses reflection
+to resolve methods on CLR types. Interop settings have no bearing on this
+internal mechanism.
 
-Jint uses reflection-based method resolution on CLR types regardless of the
-interop settings. A user-defined script invoking ToObject() on a JObject
-activates Newtonsoft.Json's deserializer. Together, these formed a gadget chain
-from attacker-controlled JSON payload to System.Diagnostics.Process:
+A user-defined script invoked ToObject() on a JObject, activating the
+Newtonsoft.Json's deserializer. Together, these formed a gadget chain from
+attacker-controlled JSON payload to System.Diagnostics.Process:
 
 ```
 data.ToObject(cfg).Start(psi.ToObject(cfg)).StandardOutput.ReadToEnd();
 ```
 
-The script triggers the deserialization of the following malicious JSON payload
-via a serializer configured with TypeNameHandling.All. This constructs a
-Process, starts it, and reads its output:
+The script triggered the deserialization of the following malicious payload via
+a serializer configured with TypeNameHandling.All. This constructed a Process,
+started it, and read its output:
 
 ```
 {
@@ -38,8 +38,8 @@ Process, starts it, and reads its output:
 }
 ``` 
 
-Fix: Objects that implement IDictionary<string, object> bypass Jint's method
-resolution system. Converted all objects that cross the CLR-JavaScript boundary
-to ExpandoObjects. Blocked reflection types from reaching Jint for good
-measure.
+Fix: IDictionary<string, object> objects bypass Jint's method resolution
+system.  Converted anything that crosses the CLR-JavaScript boundary to
+ExpandoObjects; blocked reflection types from reaching Jint for good measure.
+asyx6 verified the fix.