CVE-2020-9801

Related Files

Safari Type Confusion / Sandbox Escape

Posted Oct 1, 2020

Authored by timwr, Insu Yun, Taesoo Kim, Jungwon Lim, Yonghwi Jin | Site metasploit.com

This Metasploit module exploits an incorrect side-effect modeling of the 'in' operator. The DFG compiler assumes that the 'in' operator is side-effect free, however the embed element with the PDF plugin provides a callback that can trigger side-effects leading to type confusion (CVE-2020-9850). The type confusion can be used as addrof and fakeobj primitives that then lead to arbitrary read/write of memory. These primitives allow us to write shellcode into a JIT region (RWX memory) containing the next stage of the exploit. The next stage uses CVE-2020-9856 to exploit a heap overflow in CVM Server, and extracts a macOS application containing our payload into /var/db/CVMS. The payload can then be opened with CVE-2020-9801, executing the payload as a user but without sandbox restrictions.

tags | exploit, overflow, arbitrary, shellcode

advisories | CVE-2020-9801, CVE-2020-9850, CVE-2020-9856

SHA-256 | fbbde1e0b4f53036aee6e135d84e5add073f53c612d6996cee132e6170926d16

Download | Favorite | View

Apple Security Advisory 2020-05-26-7

Posted May 29, 2020

Authored by Apple | Site apple.com

Apple Security Advisory 2020-05-26-7 - Safari 13.1.1 is now available and addresses code execution and cross site scripting vulnerabilities.

tags | advisory, vulnerability, code execution, xss

systems | apple

advisories | CVE-2019-20503, CVE-2020-9800, CVE-2020-9801, CVE-2020-9802, CVE-2020-9803, CVE-2020-9805, CVE-2020-9806, CVE-2020-9807, CVE-2020-9843, CVE-2020-9850

SHA-256 | 8b7dce5d32dceb835cd62c85f176c7a87bd99a3dbad33629c6c8dd27534b2540

Download | Favorite | View