Escaping the Edge sandbox: A bug that speaks for itself | Hacker News Reader

Escaping the Edge sandbox: A bug that speaks for itself

microsoftedge.github.io

102 pointstodsacerdoti14 comments

Open articleView on HN

Would this even be possible if NumAttrs preceded Attrs[]?

Nice finding

Great write up

It's spectacularly well written, an engrossing read for sure.

author names sound familiar, wheren’t they working for a spyware vendor?

Candreva used to work for Truel, which got bought by a spyware vendor called Variston in 2018. His LinkedIn says he worked there 2018-2022. Amnesty International discovered a hacking campaign using their spyware in the UAE, and Google wrote a blog post about it. https://blog.google/threat-analysis-group/spyware-vendors-us...

Bartoli has been a security researcher for a long time.

Yes, they work for Microsoft.

Zing!

But yeah, the blog is hosted on https://microsoftedge.github.io/ which seems to be an official Microsoft account.

The hook:

    In this blog post, we will share the story about how we discovered a critical stack corruption bug that has existed in Windows for more than 20 years.

The drama:

    The bug was found in a core Windows OS library which is used by countless software products but is most notably reachable from within the sandbox of all Chromium-based browsers, exposing a sandbox escape which is reachable from the web via JavaScript.

Yeah, yeah, but surely all that old cruft is wrapped up in safety bubble wrap today.

The sting:

    The first thing we noticed was that the crash did not trigger the corruption of a stack canary.

Surely an oversight:

     From the build scripts it was clear that the library was compiled with /GS (Stack Canaries). In disbelief, we opened the binary in IDA pro and saw the canary check in the relevant function.

Damn, the bubble wrap got popped.

Overall, this is a fun read and worthy of Phrack 71 (?) (awaiting submissions).

And interestingly Firefox was not vulnerable because they sanitise the input (stripping XML) which as the report says, does lose them the features the XML offers on Windows.

Personally it seems to me those features should go through a more restricted channel from JS, like an API with a strict data structure and Firefox was right to sanitise it.

Yes, Firefox did the right thing here, and it's arguably a bug in Chromium that it exposed SAPI to the Web. As a general rule, you shouldn't expose platform-specific APIs to Web content, if for no other reason than to avoid Web content accidentally relying on it and having the platform behavior becoming a de facto part of the spec. The fact that it avoided a 0-day is a nice side effect of that conservatism.

Mm. Good point. I wonder if that's why Microsoft has notices that their AI "requires Edge" - I'd assumed they were just trying to get people to switch browsers and a UA spoof did seem to work fine, but I hadn't tried any TTS features.

Having platform behaviour be a defacto part of the spec is probably not a downside for them :)

It's definitely funny that this article portrays this as Firefox removing functionality.

Great advertisement for Bing Chat lol

> In line with our goal to make Microsoft Edge the most secure browser for Windows

That qualification is as telling as the bug.

Reply on news.ycombinator.com