# Two Lines Of JScript For $20,000 – Pwn2Own Miami 2022

ICONICS Genesis64 opens .tdfx template files without auth and executes embedded JScript.NET, letting an attacker run arbitrary code via ActiveXObject.

- Payout: $20,000
- Severity: high
- Program: ICONICS
- Credited: Ben McBride
- Disclosed: 2022-09-29
- CVE: CVE-2022-33317
- Write-up quality: 6/10
- Original: https://trenchant.io/two-lines-of-jscript-for-20000-pwn2own-miami-2022/
- Library page: https://bugbountylibrary.com/r/blog%3Atrenchant-io-two-lines-of-jscript-for-20000-pwn2own-miami-2022
- Tags: domain:desktop impact:rce kind:bounty platform:blog sev:high technique:recon technique:source-review vuln:auth-bypass vuln:deserialization vuln:rce

**Target:** GraphWorX64 .tdfx template file parser
**Root cause:** The .tdfx template file format embeds a ScriptCodeManager with JScriptNet scripts that are executed on file open, and unlike .gdfx files the .tdfx path requires no authentication.
**Steps:**
1. Install ICONICS Genesis64 with GenDemo examples
2. Locate a .tdfx GraphWorX64 template containing a `script:ScriptCodeManager`/`script:ScriptCode` tag
3. Insert JScript.NET payload into the ScriptCode CDATA: `var objShell = new ActiveXObject("Shell.Application"); objShell.ShellExecute("calc.exe", "", "calc.exe", "open", 0);`
4. Open the .tdfx file in the target application; no login prompt appears
5. Script executes, spawning calc.exe
**How found:** Surveyed default-handled file types in the install directory, grepping for interesting strings; spotted `ScriptCode`/`ScriptCodeManager` tags in .gdfx files (blocked by auth), then found the same tags in .tdfx templates which opened without authentication.
**Exploitation:** Attacker delivers a crafted .tdfx file to a victim; opening it in Genesis64 executes the embedded JScript.NET without authentication, achieving arbitrary code execution in the user context.
**Insight:** When a vendor gates one file format behind auth, check sibling formats sharing the same parser/feature tags — the auth check is often applied per-extension rather than in the shared deserialization/script-execution path.