Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-8371

CVE-2018-8371: ChakraCore RCE Vulnerability

7.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2018-8371
GHSA ID
GHSA-85j8-g29g-m326
EPSS Score
0.91018%
CWE
CWE-787
Published
5/13/2022
Updated
10/6/2023
KEV Status
No
Technology
TechnologyC#

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
Microsoft.ChakraCorenuget< 1.10.11.10.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The provided vulnerability information (CVE-2018-8371) describes a memory corruption issue in ChakraCore's scripting engine leading to RCE via an out-of-bounds write (CWE-787). However, the GitHub patch details, commit diffs, and specific technical writeups identifying the exact vulnerable functions are not available in the provided sources. Public advisories (NVD, GitHub) only reference high-level descriptions of the flaw ('handling objects in memory') without disclosing function names, file paths, or implementation specifics. While the vulnerability likely involves functions related to object memory management, JIT compilation, or array operations in ChakraCore, the lack of concrete technical documentation or patch analysis makes it impossible to identify specific functions with high confidence.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* r*mot* *o** *x**ution vuln*r**ility *xists in t** w*y t**t t** s*riptin* *n*in* **n*l*s o*j**ts in m*mory in Int*rn*t *xplor*r, *k* "S*riptin* *n*in* M*mory *orruption Vuln*r**ility." T*is *****ts Int*rn*t *xplor*r *, Int*rn*t *xplor*r **, Int*rn*t

Reasoning

T** provi*** vuln*r**ility in*orm*tion (*V*-****-****) **s*ri**s * m*mory *orruption issu* in ***kr**or*'s s*riptin* *n*in* l***in* to R** vi* *n out-o*-*oun*s writ* (*W*-***). *ow*v*r, t** *it*u* p*t** **t*ils, *ommit *i**s, *n* sp**i*i* t***ni**l w