Free Link

Disclaimer: This article is based on the amazing write up by Moritz Sanft that can be found here but with more information added to make it easier to understand.

What you need to know

There are some concepts that you need to understand before reading the PoC, I will explain them before diving into the bug details

Function constructors in Javascript

In Javascript, it’s possible to create a function using the “Function()” constructor, the code goes something like this

var myfunc = Function() // equivalent to empty function, i.e. function myfunc  () {}

As seen above we created an empty function by calling the function constructor, now what if we want to add code to that function, well, we can do something like the following.

var myfunc = Function("alert(123)")
//The above code is equivalent to the following
function myfunc() {
  alert(123);
}

As seen above the string passed to the function constructor is treated as the function body, we can also create functions with arguments as below

var myfunc = Function("x","alert(x)")
//The above code is equivalent to the following
function…