Tags: pwn
Rating: 4.0
MJS is a Javascript Engine "designed for microcontrollers with limited resources".
Of note, it integrates pointers to C structure and functions, into the engine as normal JS value. Furthermore, it allows pointer arthimatic on those values. Thus, we can take a pointer to an exposed function, and point it at an arbitrary other function instead.
Our approach to RCE is to create a pointer to MJS's Foreign Function Interface (FFI), and then call arbitrary libc functions.