wasm-binary-security

> This doesn't really seem to offer anything useful, or even contain new information. You are right in that we do not try to attack a concrete host implementation or aim to break out of the sandbox. I disagree, however, that security inside a WebAssembly binary is irrelevant. If an attacker can arbitrarily read/write in linear memory, it depends on the imported host functions what can be done. The larger WebAssembly applications are (and we believe they will become larger in the future, and incorporate DOM functions, as in our PoC application), the higher the risk that host APIs can be abused. This is troubling especially where there is no sandbox (on some standalone VMs), but even in browsers (where it opens the door for a new type of cross-site scripting). For example, even if you only call JS eval() with a constant string in your C cod

The exploit is against a vulnerable library (the actual input file is here: https://github.com/sola-st/wasm-binary-security/blob/master/...) If you have a wasm application with vulnerabilities (e.g. in the libraries) there are no mitigations that native binaries provide, so simple buffer overflows give you RCEs again. It's still within the sandbox, but the threat is as severe as running eval on user supplied inputs as there might be useful stuff in that sandbox.

This doesn't really seem to offer anything useful, or even contain new information. eg: * no corruption of, nor access to host memory. * no corruption of, nor access to memory or other processes. It looks like what they did is create a wasm file that generates a JS "Alert !!!" string, then blindly runs that string in the browser without any kind of validation? It's hard to tell from looking at their code though: https://github.com/sola-st/wasm-binary-security/blob/master/... The html page there seems to be missing the "main.js" to see what's happening. :( --- Hmmm, it might be this main.js, which looks (without checking) like it came from Emscripten: https://github.com/sola-st/wasm-binary-security/blob/master/...