1-click Remote Code Execution via Twitch Embed

Disclosed by
JayTaelien
  • Engagement Undisclosed
  • Disclosed date 5 days ago
  • Reward $5,500
  • Priority P1 Bugcrowd's VRT priority rating
  • Status Resolved This vulnerability has been accepted and fixed
Summary by JayTaelien

attacker page
-> Discord Twitch rich embed
-> Twitch force_manifest_node parser gap
-> inline HLS master to attacker media playlist, which lets you set a custom stitched-ad OMID verifier script (this gets JS execution)
-> inherited-origin Discord popout
-> V8 RegExp UAF to stable compressed-cage read/write
-> Response(128) native-pointer leak, JSPI stack-control primitive, native ROP
-> barriered Electron IPC-wrapper export (proof via the Calculator launch step)
-> detached main-process WebDAV file-dialog activation to Windows WebClient demand-start
-> Discord clip-file TOCTOU to updater .exe control
-> cmd.exe /d /k echo success

IPC calls used in order for sandbox escape in TOCTOU:

  1. DISCORD_APP_GET_PATH
  2. DISCORD_FILE_MANAGER_SHOW_OPEN_DIALOG
  3. DISCORD_DEBUG_STASH_CLIP_DECIDER_DATA
  4. DISCORD_FILE_MANAGER_CREATE_DIRECTORY_IF_NOT_EXISTS
  5. DISCORD_DEBUG_STASH_CLIP_DECIDER_DATA (again)
  6. DISCORD_MOVE_CLIP + DISCORD_DEBUG_STASH_CLIP_DECIDER_DATA (concurrent)
  7. DISCORD_UPDATE_CLIP_METADATA
  8. DISCORD_DEBUG_STASH_CLIP_DECIDER_DATA
  9. DISCORD_DELETE_CLIP
  10. DISCORD_NATIVE_MODULES_FINISH_UPDATER_BOOTSTRAP
Activity