Abusing Adobe Reader’s JavaScript APIs
summary
Research describes auditing SpiderMonkey bytecode in Adobe's jas bin to find nearly 100 JavaScript-API bugs and chains that achieve RCE without memory corruption. Technique hijacks implicit calls and a privileged eval loaded to root context, overloads a method inside a trusted function privilege block, then abuses undocumented collab methods such as URI.putData to write an attached payload (OStream) to disk. Demo shows dumping a DLL and attaining code execution on Acrobat Pro (Windows and macOS) and explains why Reader sandboxing affects exploitability.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 4:04Understanding the Attack Surface
- 10:44Understanding Attack Surface
- 17:23Vulnerability Discovery
- 25:03Constructing the exploit
- 32:50Reader for MacOSX DEMO
related talks
48mTackling Privilege Escalation with Offense and Defense
33mPDF - Mess With The Web
58mExploiting Adobe Flash Player In The Era Of Control Flow Guard
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
01h 03mEffects Malware hunting in Cloud environment
33mWebKit Everywhere: Secure or Not?
01h 06mPDF Attack: A Journey from the Exploit Kit to the Shellcode (Part 2/2)
27mPwning Electron Application : Analysis and Defense of Vulnerabilities in Electron Applications