diff options
Diffstat (limited to '_log/jint-gadget-chain-rce.md')
| -rw-r--r-- | _log/jint-gadget-chain-rce.md | 32 |
1 files changed, 16 insertions, 16 deletions
diff --git a/_log/jint-gadget-chain-rce.md b/_log/jint-gadget-chain-rce.md index 081ec0e..4241419 100644 --- a/_log/jint-gadget-chain-rce.md +++ b/_log/jint-gadget-chain-rce.md @@ -4,25 +4,25 @@ date: 2026-07-18 layout: post --- -Asyx6, a bounty hunter, reported a CVSS 9.9 RCE vulnerability in a six-year-old -program. +Received a CVSS 9.9 RCE vulnerability report from security researcher asyx6 +today. -The application exposed JSON data from HTTP requests to Jint as -JObjects—presumed safe because the CLR interop was disabled in the Jint -configuration. It wasn't. +Six-year-old program exposed JSON data from HTTP requests to Jint as +JObjects—presumed safe because CLR interop was disabled. Jint uses reflection +to resolve methods on CLR types. Interop settings have no bearing on this +internal mechanism. -Jint uses reflection-based method resolution on CLR types regardless of the -interop settings. A user-defined script invoking ToObject() on a JObject -activates Newtonsoft.Json's deserializer. Together, these formed a gadget chain -from attacker-controlled JSON payload to System.Diagnostics.Process: +A user-defined script invoked ToObject() on a JObject, activating the +Newtonsoft.Json's deserializer. Together, these formed a gadget chain from +attacker-controlled JSON payload to System.Diagnostics.Process: ``` data.ToObject(cfg).Start(psi.ToObject(cfg)).StandardOutput.ReadToEnd(); ``` -The script triggers the deserialization of the following malicious JSON payload -via a serializer configured with TypeNameHandling.All. This constructs a -Process, starts it, and reads its output: +The script triggered the deserialization of the following malicious payload via +a serializer configured with TypeNameHandling.All. This constructed a Process, +started it, and read its output: ``` { @@ -38,8 +38,8 @@ Process, starts it, and reads its output: } ``` -Fix: Objects that implement IDictionary<string, object> bypass Jint's method -resolution system. Converted all objects that cross the CLR-JavaScript boundary -to ExpandoObjects. Blocked reflection types from reaching Jint for good -measure. +Fix: IDictionary<string, object> objects bypass Jint's method resolution +system. Converted anything that crosses the CLR-JavaScript boundary to +ExpandoObjects; blocked reflection types from reaching Jint for good measure. +asyx6 verified the fix. |