{"uuid": "464305f7-5106-4129-8666-c6fe39b33f66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-4404", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/browser/safari_proxy_object_type_confusion.rb", "content": "{\"aliases\": [], \"arch\": \"python, cmd\", \"author\": [\"saelo\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a type confusion bug in the Javascript Proxy object in\\n          WebKit. The DFG JIT does not take into account that, through the use of a Proxy,\\n          it is possible to run arbitrary JS code during the execution of a CreateThis\\n          operation. This makes it possible to change the structure of e.g. an argument\\n          without causing a bailout, leading to a type confusion (CVE-2018-4233).\\n\\n          The JIT region is then replaced with shellcode which loads the second stage.\\n          The second stage exploits a logic error in libxpc, which uses command execution\\n          via the launchd's \\\"spawn_via_launchd\\\" API (CVE-2018-4404).\", \"disclosure_date\": \"2018-03-15\", \"fullname\": \"exploit/osx/browser/safari_proxy_object_type_confusion\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 17:11:13 +0000\", \"name\": \"Safari Proxy Object Type Confusion\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/osx/browser/safari_proxy_object_type_confusion.rb\", \"platform\": \"OSX,Python,Unix\", \"post_auth\": false, \"rank\": 0, \"ref_name\": \"osx/browser/safari_proxy_object_type_confusion\", \"references\": [\"CVE-2018-4233\", \"CVE-2018-4404\", \"URL-https://github.com/saelo/cve-2018-4233\", \"URL-https://github.com/saelo/pwn2own2018\", \"URL-https://saelo.github.io/presentations/blackhat_us_18_attacking_client_side_jit_compilers.pdf\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Python payload\", \"Command payload\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:30.280167Z"}