So what does it do? https://github.com/r4j0x00/exploits/blob/7ba55e5ab034d058774...
Repo leads to this one from a few days ago, looks similar, maybe can help?
https://github.com/r4j0x00/exploits/tree/7ba55e5ab034d058774...
Chrome zero-day released on GitHub – fixed on V8 but still works on latest
21–30 of 160 posts
Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest
#22So what I really want to know is: what happens at Cloudflare--which uses v8 to implement Cloudflare Workers in shared memory space--when this kind of stuff happens? (Their use is in some sense way more "out on a limb" than a web browser, where you would have to wait for someone to come to your likely-niche page rather than just push the attack to get run everywhere.)
This is what happens: Within an hour of V8 pushing the fix for this, our build automation alerted me that it had picked up the patch and built a new release of the Workers Runtime for us. I clicked a button to start rolling it out. After quick one-click approvals from EM and SRE, the release went to canary. After running there for a short time to verify no problems, I clicked to roll it out world-wide, which is in pr…
The other benefit you have is that anything running in the workers has to go through CI/CD, so you’d see anyone actively trying to exploit this.
Hope you there is also some scanning for this put in place.
Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest
#23This bug didn't bypass our sandbox so everything is safe and no need to panic.
Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest
#24So what does it do? https://github.com/r4j0x00/exploits/blob/7ba55e5ab034d058774...
I converted it to binary with a pack("L", ...) loop and loaded it in Ghidra as a raw x86_64 binary. I don't fully understand it, but i think it's searching the address space for some kind of function entry point and then calling it with "calc.exe". So probably the standard PoC shellcode.
For anyone else wanting to analyze this:
echo '\xfc\x48\x83\xe4\xf0\xe8\xc0\x00\x00\x00\x41\x51\x41\x50\x52\x51\x56\x48Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest
#25So what I really want to know is: what happens at Cloudflare--which uses v8 to implement Cloudflare Workers in shared memory space--when this kind of stuff happens? (Their use is in some sense way more "out on a limb" than a web browser, where you would have to wait for someone to come to your likely-niche page rather than just push the attack to get run everywhere.)
This is what happens: Within an hour of V8 pushing the fix for this, our build automation alerted me that it had picked up the patch and built a new release of the Workers Runtime for us. I clicked a button to start rolling it out. After quick one-click approvals from EM and SRE, the release went to canary. After running there for a short time to verify no problems, I clicked to roll it out world-wide, which is in pr…
Thanks for the response! This didn't really answer what I was curious about, though: like, you answered what happens during the minutes after the fix being pushed, but I am curious about the minutes after the exploit being released, as the mention of "zero day" made me think that this bug could only have been fixed in the past few hours (and so there were likely hours of Cloudflare going "omg what now?" with engineers trying to help come up with a patch, etc.).
However... for this comment I then wanted to see how long ago that patch did drop, and it turns out "a week ago" :/... and the real issue is that neither Chrome nor Edge have merged the patch?!
https://therecord.media/security-researcher-drops-chrome-and...
> Agarwal said he responsibly reported the V8 security issue to the Chromium team, which patched the bug in the V8 code last week; however, the patch has not yet been integrated into official releases of downstream Chromium-based browsers such as Chrome, Edge, and others.
So uhh... damn ;P.
> I may be biased but I think this is debatable. If you want to target a specific victim, ...
FWIW, I had meant Cloudflare as the victim, not one of Cloudflare's users: I can push code to Cloudflare's servers and directly run it, but I can't do the same thing to a user (as they have to click a link). I appreciate your point, though (though I would also then want to look at "number of people I can quickly affect"). (I am curious about this because I want to better understand the mitigations in place by a service such as Cloudflare, as I am interested in the security ramifications of doing similar v8 work in distributed systems.)
Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest
#26Earlier quoted context omitted.
This is what happens: Within an hour of V8 pushing the fix for this, our build automation alerted me that it had picked up the patch and built a new release of the Workers Runtime for us. I clicked a button to start rolling it out. After quick one-click approvals from EM and SRE, the release went to canary. After running there for a short time to verify no problems, I clicked to roll it out world-wide, which is in pr…
The other benefit you have is that anything running in the workers has to go through CI/CD, so you’d see anyone actively trying to exploit this. Hope you there is also some scanning for this put in place.
All code executed on Workers has to have been uploaded through our API -- we don't allow eval() or dynamically compiling Wasm at runtime. This ensures that we have a paper trail in case of an exploit.
Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest
#27So what does it do? https://github.com/r4j0x00/exploits/blob/7ba55e5ab034d058774...
I ran both the exploits[0][1] on Chrome (89.0.4389.114) on Windows and got
AW SNAP: Access violation on both.
I then straced the tab processes on Debian (as best as I could guess which chrome child processes were tabs via top activity as I loaded stuff in them) and ran the exploit. Nothing seemed unusual. Just all the system calls stopped after the exploit was run, and the tab crashed. I guess it would be good to gdb to the actual JS VM process and stepi through the instructions, but I don't know how to get the actual process that runs the JSVM for a chrome tab.
I forked the repo so I could easily run it from a GitHub pages site. I don't know what it does but I don't think it does anything:
[0]: https://dosycorps.github.io/exploits/chrome-exploit/exploit....
[1]: https://dosycorps.github.io/exploits/chrome-0day/exploit.htm...
Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest
#28Here is an article with a lot more detail (high level, not technical) about this... on a random website none of us have ever heard of and so which might be a phishing attack for people like me who immediately went to Google to find more information (and with a few "shockers" in--such as Chrome and Edge not having patched it yet, despite the patch dropping a week ago--to maybe get some viral sharing, such as what I am doing now ;P).
https://therecord.media/security-researcher-drops-chrome-and...
Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest
#29Here is an article with a lot more detail (high level, not technical) about this... on a random website none of us have ever heard of and so which might be a phishing attack for people like me who immediately went to Google to find more information (and with a few "shockers" in--such as Chrome and Edge not having patched it yet, despite the patch dropping a week ago--to maybe get some viral sharing, such as what I am…
The screenshot suggests that all you need to do for the exploit to work is to open the html/js file, but doing this on windows just results in "Aw, Snap!" page. Others in this thread have confirmed this.
Re: Chrome zero-day released on GitHub – fixed on V8 but still works on latest
#30Im just curious on thoughts about sharing these on twitter. Shouldn't they be shared directly with Google. Since its web people can create exploits pretty quickly.