wasm-memory-corruption-xss

name

wasm-memory-corruption-xss

description

Exploit WebAssembly linear memory corruption to bypass XSS filters and achieve DOM XSS. Use this skill whenever the user mentions WebAssembly, WASM, Emscripten, linear memory corruption, memory overflow, heap corruption, XSS bypass, or any scenario where a web app uses WASM modules and sanitization might be bypassed through memory manipulation. This is especially relevant when investigating Emscripten-compiled applications with user-controlled data that gets rendered to the DOM.

WebAssembly Linear Memory Corruption to DOM XSS

This skill guides you through exploiting memory corruption vulnerabilities in WebAssembly modules to bypass XSS filters. The core technique corrupts writable constants in WASM linear memory (like HTML templates) instead of attacking sanitized input directly.

When to Use This Skill

Use this skill when:

• Investigating web applications that use WebAssembly modules (especially Emscripten-compiled)
• XSS filters are in place but you suspect memory corruption vulnerabilities
• You need to understand WASM memory layout and exploitation techniques
• Debugging WASM applications in Chrome DevTools
• Analyzing Emscripten glue code and Module.cwrap calls

Core Concept

In WebAssembly:

• Code lives in non-writable executable pages
• Data (heap, stack, globals, "constants") lives in writable linear memory (64KB pages)
• Buggy C/C++ code can write out-of-bounds and overwrite adjacent objects
• If a constant string used for HTML templating is corrupted, sanitized input becomes executable JavaScript

Vulnerability Pattern

Typical Data Model

typedef struct msg {
    char *msg_data;       
     msg_data_len;  
     msg_time;         
     msg_status;       
} msg;

 
    msg *mess;            
     size;          
     capacity;      
} stuff;