[~]mobilehackerforhire$ hire --now
    cd ../tutorials
    root@mhfh:~#less posts/cve-2024-23222.md
    posts/cve-2024-23222.md
    CVE-2024-23222· 18 min · mhfh research · 2024-02-04

    Weaponizing WebKit Type Confusion for iOS RCE

    We walk through triggering the type confusion in JavaScriptCore, building a fake object primitive, and pivoting to arbitrary read/write inside Safari on iOS 17.3.

    #iOS#WebKit#RCE#Safari
    $cat snippet.sh
    function trigger() {
  let arr = [1.1, 2.2, 3.3];
  let oob = new ArrayBuffer(0x1000);
  arr.__proto__ = oob.__proto__;
  return arr[0x100];
}

    Overview

    CVE-2024-23222 is a type confusion vulnerability in JavaScriptCore that enables a malicious web page to corrupt the JS heap and gain arbitrary read/write inside the Safari renderer.

    In this write-up we will:

    1. Trigger the bug from a minimal HTML PoC.
    2. Build the fakeobj / addrof primitives.
    3. Pivot to arbitrary R/W inside Safari.
    4. Discuss detection and mitigation.

    ⚠️ For research and lawful security testing only.

    1. Bug primer

    The optimizer fails to invalidate a speculation guard when an attacker mutates __proto__ between two type checks. This lets us alias a JSArray of doubles with an ArrayBuffer view.

    $cat snippet.js
    function trigger() {
  let arr = [1.1, 2.2, 3.3];
  let oob = new ArrayBuffer(0x1000);
  arr.__proto__ = oob.__proto__;
  return arr[0x100]; // OOB read
}

    2. addrof / fakeobj

    With the OOB primitive in hand, we build the classic pair:

    PrimitivePurpose
    addrof(o)Leak the address of any JS object
    fakeobj(p)Materialize a JSObject at attacker-controlled p

    3. Pivot to R/W

    We forge a fake Uint32Array whose vector pointer we control, giving us arbitrary read/write within the renderer process.

    $cat snippet.js
    let fake = fakeobj(addrof(victim) + 0x10);
fake[0] = 0x41414141;

    4. Detection

    Look for repeated __proto__ swaps between numeric arrays and typed array views in renderer logs. Lockdown Mode disables the JIT path that makes this bug exploitable.

    References

    • Apple HT214061
    • WebKit bug tracker entry 267047