Miggo Logo
Miggo Vulnerability Database
→
CVE-2017-8658

CVE-2017-8658: ChakraCore RCE Vulnerability

9.8

CVSS Score
3.0

Basic Information

CVE ID
CVE-2017-8658
GHSA ID
GHSA-8v2h-4jpm-3wfm
EPSS Score
0.96909%
CWE
CWE-119
Published
5/17/2022
Updated
10/24/2023
KEV Status
No
Technology
TechnologyC#

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
Microsoft.ChakraCorenuget< 1.6.11.6.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The analysis focused on: 1) The commit message specifically calls out improper handling of deferred function stubs in formal arguments (CVE-2017-8658), fixed in Parse.cpp. 2) Security.cpp changes show critical fixes to constant blinding mentioned in the vulnerability description. 3) ObjTypeSpecFldInfo.cpp modifications add bounds checks to prevent memory corruption vectors. These functions directly match the vulnerability patterns described in the CVE and commit details.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* r*mot* *o** *x**ution vuln*r**ility *xists in t** w*y t**t t** ***kr* J*v*S*ript *n*in* r*n**rs w**n **n*lin* o*j**ts in m*mory, *k* "S*riptin* *n*in* M*mory *orruption Vuln*r**ility".

Reasoning

T** *n*lysis *o*us** on: *) T** *ommit m*ss*** sp**i*i**lly **lls out improp*r **n*lin* o* ****rr** `*un*tion` stu*s in *orm*l *r*um*nts (*V*-****-****), *ix** in `P*rs*.*pp`. *) `S**urity.*pp` ***n**s s*ow *riti**l *ix*s to *onst*nt *lin*in* m*ntion