JailbreakMe PS4 4.0x: PS4 4.0x WebKit RCE Exploit by Qwertyoruiopz!

Following the PS4 Playground for Firmware 3.55 and PS4 3.55 File Browser, today PlayStation 4 developer qwertyoruiopz made available a PS4 4.0x WebKit RCE Exploit dubbed JailbreakMe PS4 4.0x with details via Twitter below!

PS4 Link (click go 3 times): http://rce.party/ps4/ / local rce.rar (3 KB) via Nesterwork / Local RCE v2.rar (6 KB) via Nesterwork / Local rce v3.rar (12 KB) via Nesterwork

According to the developer's Tweets below, the bug used is a stack uninit read yielding UaF and the actual exploit does nothing but give you read/write/infoleak arbitrary JS object primitives.

He also confirmed the exploit won't work on PS4 4.50 as Sony updated WebKit past a vulnerable version unfortunately, but it's still an entry point for those on PlayStation 4 OFW 3.55 through 4.07.

That said, if you give it a try on a PlayStation 4 under 4.50 and receive a ffff000000000539 error prompt it's expected output for the exploit's success.

Spoiler: Related Twitter Tweets

Cheers to @DarkElementPL, @DoxyMarket, @hyndrid, @ryan111, @toni1988 and @vettegast for sharing the news in the PSXHAX Shoutbox!

 

[HydrogenNGU]

Added to the OP now, thanks @Nesterwork!

Also from mntadr56 is the jailbreakME expl.js file for those interested:

Download: expl.js (13.2 KB)

That guy unblocked me from Twitter after months from being a skid. I wonder why

Interesting, so this he got working then eh?

https://www.psxhax.com/threads/ps4-developer-specter-on-pegasus-trident-chaitin-tech-exploit.1151/

Pegasus is not the same as the WebKit exploit.

 

[xthird16]

That guy unblocked me from Twitter after months from being a skid. I wonder why

mntadr56 that BS guy before claiming himself to be a dev and releasing something on november 5... lol

 

[JackQ]

I don't know why but now when I am pressing the "go" button its suck and I need to load the page again.. I am on 4.05.. no way sony patched it without me updating right?

 

[NoctivagotH]

I was about to update my 3.55 PS4 (a.k.a Dusty) to 4.50 because I thought the scene got stuck. Thanks to Odin I didn't do it!

 

[JackQ]

Never mind, works fine now

 

[umbjolt]

I have tried again and after pressing "Go" a "Not enought free memory in memory system" message appear!

 

[Centrino]

Restart ur ps. Try 1s presses with a 1s delay between presses

 

[umbjolt]

Restart ur ps. Try 1s presses with a 1s delay between presses

Thanks but no dice. Before I sent the message, it works one time but shown that error when I press the second button after the "exploit succedeed" but now, I can't go deeper. Clicking go on my console make that error appear, dunno why

 

[lobimagobi]

Now let's try to find a kernel exploit

 

[endimetal]

Hi there..Is this exploit came up with debug setting?