Published: 11/01/2019 Updated: 07/11/2023

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 1000

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

In iOS prior to 11.4 and macOS High Sierra prior to 10.13.5, a memory corruption issue exists and was addressed with improved memory handling.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apple iphone os
apple mac os x

This Metasploit module exploits a type confusion bug in the Javascript Proxy object in WebKit The DFG JIT does not take into account that, through the use of a Proxy, it is possible to run arbitrary JS code during the execution of a CreateThis operation This makes it possible to change the structure of eg an argument without causing a bailout, ...

This module exploits a type confusion bug in the Javascript Proxy object in WebKit The DFG JIT does not take into account that, through the use of a Proxy, it is possible to run arbitrary JS code during the execution of a CreateThis operation This makes it possible to change the structure of eg an argument withou ...

This module exploits a type confusion bug in the Javascript Proxy object in WebKit. The DFG JIT does not take into account that, through the use of a Proxy, it is possible to run arbitrary JS code during the execution of a CreateThis operation. This makes it possible to change the structure of e.g. an argument without causing a bailout, leading to a type confusion (CVE-2018-4233). The JIT region is then replaced with shellcode which loads the second stage. The second stage exploits a logic error in libxpc, which uses command execution via the launchd's "spawn_via_launchd" API (CVE-2018-4404).

msf > use exploit/osx/browser/safari_proxy_object_type_confusion
msf exploit(safari_proxy_object_type_confusion) > show targets
    ...targets...
msf exploit(safari_proxy_object_type_confusion) > set TARGET < target-id >
msf exploit(safari_proxy_object_type_confusion) > show options
    ...show and set options...
msf exploit(safari_proxy_object_type_confusion) > exploit

This module exploits a type confusion bug in the Javascript Proxy object in WebKit. The DFG JIT does not take into account that, through the use of a Proxy, it is possible to run arbitrary JS code during the execution of a CreateThis operation. This makes it possible to change the structure of e.g. an argument without causing a bailout, leading to a type confusion (CVE-2018-4233). The JIT region is then replaced with shellcode which loads the second stage. The second stage exploits a logic error in libxpc, which uses command execution via the launchd's "spawn_via_launchd" API (CVE-2018-4404).

msf > use exploit/osx/browser/safari_proxy_object_type_confusion
msf exploit(safari_proxy_object_type_confusion) > show targets
    ...targets...
msf exploit(safari_proxy_object_type_confusion) > set TARGET < target-id >
msf exploit(safari_proxy_object_type_confusion) > show options
    ...show and set options...
msf exploit(safari_proxy_object_type_confusion) > exploit

CWE-119 https://support.apple.com/HT208849 https://www.exploit-db.com/exploits/45998/https://support.apple.com/HT208848%2C https://nvd.nist.gov https://packetstormsecurity.com/files/150779/Safari-Proxy-Object-Type-Confusion.html https://www.rapid7.com/db/modules/exploit/osx/browser/safari_proxy_object_type_confusion

CVE-2018-4404

Vulnerability Summary

Vulnerability Trend

Exploits

Metasploit Modules

References

Vulmon Search

About

Products

Connect