CVE-2019-17026 PoC — Mozilla Firefox、Firefox ESR和Thunderbird IonMonkey JIT compiler 安全漏洞

Source

https://github.com/maxpl0it/CVE-2019-17026-Exploit

Associated Vulnerability

Title:Mozilla Firefox、Firefox ESR和Thunderbird IonMonkey JIT compiler 安全漏洞 (CVE-2019-17026)
Description:Mozilla Firefox等都是美国Mozilla（Mozilla）基金会的产品。Mozilla Firefox是一款开源Web浏览器。Mozilla Firefox ESR是Firefox(Web浏览器)的一个延长支持版本。IonMonkey JIT compiler是其中的一个JIT编译器。Mozilla Thunderbird是一套从Mozilla Application Suite独立出来的电子邮件客户端软件。该软件支持IMAP、POP邮件协议以及HTML邮件格式。 Mozilla Firef

Description

An exploit for CVE-2019-17026. It pops xcalc and was tested on Ubuntu (x64).

Readme

# CVE-2019-17026 - A Firefox JIT bug

- Original bug caught in the wild by [Qihoo 360](https://blogs.360.cn/post/apt-c-06_0day.html).
- Exploit written by [maxpl0it](https://twitter.com/maxpl0it).
- Works on Firefox < 72.0.1

This is an exploit for CVE-2190-17026:
*IonMonkey type confusion with StoreElementHole and FallibleStoreElement*

This exploit does not use a sandbox escape, so for testing the *security.sandbox.content.level* attribute in *about:config* needs to be set to 0. It should be possible to chain this with [CVE-2020-0674](https://github.com/maxpl0it/CVE-2020-0674-Exploit) via [PAC](https://googleprojectzero.blogspot.com/2017/12/apacolypse-now-exploiting-windows-10-in_18.html) to get a sandbox escape on Windows.

The writeup for this vulnerability and the steps taken to exploit it can be found [here.](https://labs.f-secure.com/blog/exploiting-cve-2019-17026-a-firefox-jit-bug/)

File Snapshot


 [4.0K]  /data/pocs/af5badc4887ddedf776a5e2842599b31e254c686
├── [6.0K]  calc.html
└── [ 905]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!