Forging a Microsoft Edge Full Chain with Logic Bugs Only

its-summertime

I always felt bad about the whole site/browser cross integration that chrome and edge and others do. Now I feel really really really bad about it. Can almost see the marketing team's emails about what features to add, and the developers unwantingly writing the code not expecting such things to open so many holes

zhiyan

human craft is becoming rare these days

cyclopeanutopia

Stopped at > I won’t go into too much detail in this post, because I think in this era, you can just ask your agents to fill in the details :)

berofeev

Excellent write up

darkamaul

Orange is a legend and this chain is extremely impressive here. No memory corruptions, no heap shenanigans, just pure logic bugs, almost made easy to understand for the reader. As a bonus, they also posted a reverse chain: popping Edge from calc [0]. [0] https://www.youtube.com/watch?v=Bh1zglq4mLE

breakingcups

This is amazing work.

sharpshadow

The popup nightmare never stops.

tveita

> So even if you’ve never created a User Profile in the browser, just visiting www.microsoft.com is enough for Edge to create one and sign you in automatically. This is disgusting behaviour, RCE chain or not.

antonly

It's very refreshing to read such clearly written and concise technical reports.

deburo

I guess that explains the questions I had when I was mysteriously logged into Edge. I checked whether Chrome does something similar, and it can, but the setting "Sign in to Chrome when you sign in to other Google services" was set to "Don't sign in", so I'm not sure whether this is the default or not.

Vaushite

This is very awesome and cool.

adzm

> with a simple fetch(...) with credentials included, you can easily grab any Microsoft Edge user’s email from any website Wow, this is disturbing on its own

mschuster91

Oh dear god, at each further chain link I was laughing so hard that my poor cats got disturbed! This entire chain is nothing but a lesson of shame for Microsoft - if you fork a thing, better be prepared to thoroughly understand and review each corner you touch. Or you might miss important cross-references that you should update but that aren't mentioned in comments by the original developers. As for the "sign in automatically" BS that both Google and Edge push - that can go and die in a hellfire where it belongs.

akersten

Glad to now have some hard evidence I can reference whenever I bring up my strongly held intuitive opinion of "Microsoft repackaging someone else's browser and adding some extra stuff to it can only make Edge strictly worse"

1vuio0pswjnm7

A good summary of the so-called "modern" browser But what hapens when there's no Javascript interpreter, i.e., not the so-called "modern" browser And when the OS is not Windows The so-called "modern" browser _is_ a "logic bug". It's multiple layers of stupidity if "security" is a goal