Hacking Discord for $5000 Bounty

An introduction to V8 exploit development, explaining how a type confusion bug in the JavaScript engine led to remote code execution on Discord.

Note: The Discord team acted super fast when we reported this bug and fixed it in an hour. Kudos to them. And Vimeo also fixed the issue. In this video, I’ll walk you through a super cool bug we found back in 2021 that let us get remote code execution on a computer—just by sending a message. The real goal here isn’t just to show off this bug but give you a fun intro to V8 exploit development and bug hunting. We’ll dive into stuff like how the V8 engine works, cover things like the Ignition interpreter, TurboFan, type confusion, pointer compression, pointer tagging, WebAssembly, and how the V8 heap is laid out—all leading up to building an actual exploit. Links: V8 N-day used: github.com/v8/v8/commit/fd29e246f65a7cee130e72cd10f618f3b82a… Detailed Root Cause Analysis of the bug I wrote: s1r1us.ninja/posts/v8-rca/ A great intro to speculative optimization in JS Engines: webkit.org/blog/10308/speculation-in-javascriptcore/ Introduction to TurboFan by DOAR-E: doar-e.github.io/blog/2019/01/28/introduction-to-turbofan/ 00:00 - Intro 01:30 - How Discord Works 03:20 - Vimeo DOM XSS 05:10 - V8 Exploitation 05:38 - V8 N-day reversing 06:00 - How Chrome executes JavaScript 07:00 - How Ignition Interpreter works 08:00 - Turbofan Speculative Compiler 11:43 - Patch Analysis 13:37 - OOB Access via Typer Confusion 15:18 - ROP? 15:35 - Nah! We are on Heap 16:05 - The Three problems 16:23 - WebAssembly for RWX Page 17:18 - What's past the array? 18:45 - Memory Optimization 19:00 - Pointer Tagging 20:00 - Pointer Compression 20:35 - Making Double array OOB 21:10 - Addrof Primitive 21:50 - Heap Read and Write Primitive 23:00 - Full Read Primitive 23:30 - Full PoC 24:10 - Outro?