Sandbox bypass for the latest AngularJS version 1.5.8 - XSS with AngularJS 0x4

angularjs fixed descent box bypass from version 1.4 7 but very quickly a new bypass was found the old bypass which overrode the char ed prototype function to screw with angularjs internals got fixed but the fix was incomplete very quickly a new bypass was found that was initially kept private eventually somebody else discovered the bypass 2 and reported it publicly on github so let's try to find the bypass for the incomplete fix ourselves let's start by testing the old bypass no alert and when we look into the console we can see the error assigned to a constructor is disallowed what does that mean let's have a look at what ensure safe assign context is doing so this is a function that takes an object as a parameter and performs a couple of checks on it it basically checks if the object passed to it is some kind of constructor as we have seen with the first bypass constructors are dangerous in that video we use the function constructor to escape the sent box and in the last escape we access the prototype of chart via the string constructor to screw with angularjs internals so it makes sense that these sandbox tries to prevent you to assign something to the constructor well the name assigned context indicates that this is a check used in assignments I set a breakpoint with the debugger keyword here so let's see what kind of objects are passed to this function so the first object path to it is the string a the second object path to it is the string constructor which will obviously then throw the exception now let's check where this is called from in the call stick it's coming from F N and F n is again this dynamically generated JavaScript code representing our expression we can take this generated code here and compare to the generated code from 1.4.7 and you can see that the fix is not super big it only added two function calls to ensure safeassign context anyhow let's try to understand what assigned context means in what cases as angularjs check an object with this function we can do this by using simple expressions so for example one plus one doesn't trigger the breakpoint sono check here that's not surprising we would expect some kind of assignment anyway right so let's do an assignment a equals two one okay this triggers the breakpoint and the object passed to it is the scope object remember from the first video that any variable you use is evaluated against the scope so the kind of makes sense let's look at the function angular generated so we zero variable zero is the one that we want to assign the tool variable to up here is s our scope so it also makes sense so now it here checks if V two is a safe object for assignments and yeah the scope is safe object we assign to it all the time after that you see the assignment happening with v2 dot a so a on the scope gets assigned the number one as you can see it always only checks the left side of an assignment so the object to the right is never checked this means we can still do stuff with the constructor it just can't be on the left side so we can assign it to a variable on the scope just fine but is that enough now that a is the string constructor let's see if we can assign something to the prototype of a first check is the first assignment which is fine but the second check will fail because a is the constructor hmm playing around like this is enough to find the bypass for the incomplete fix so go ahead pause the video and try it yourself head over to the testbed at live overflow comm slash angularjs you can do it in case you didn't get it or you just want me to tell you well here we go so we can use those evil objects on the right side of an assignment so we can assign them to anything we want but they can't be on the left side but the only evil object that can't be on the left side is the constructor so what we could do is we could assign the prototype to a instead and then we use a torch our head in the next step theoretically this should work because a contains now a prototype and not the constructor which means ensure safeassign context will not find a constructor and be happy so let's try it first assignment is on the scope so that is safe and the second check is on this weird object here but that's just the prototype and when we let the code continue we pop an alert that was super easy let's compare our bypass with what iron found on github his exploit is a little bit over complicated but in essence it's the same he assigns the prototype to a property Y of X and then accesses char add via the property same thing we just used a simple variable also this bypass still works in the latest version 1.58 but angularjs has announced that they will remove the angularjs end box in 1.6 this means that we don't need any fancy sandbox bypasses anymore and exploitation will become trivial it sounds counterintuitive but I think that's a good thing but let's discuss this in another video now let you understand angularjs sandbox bypasses I highly recommend you to watch the talk an abusive relationship with angularjs by Mario Heydrich he gives a great overview over the history of angularjs sandbox bypasses I just finished editing the video and I realized I forgot to give my disclaim and the proper credits like I did in the previous videos so here it comes a bit late I did not discover those bypasses myself great researchers like monohydrate iron Heke Gareth Hays and many more are the true brains here I merely tried to explain their hard work in a video so look them up and follow them on Twitter you