Apple Safari SOP bypass (CVE-2015-3753)

Damien Antipa and me love browser security.
Hence we always keep up to date on what is going on this field.
Few months ago Christian Schneider blogged about Chrome SOP Bypass with SVG. We decided to poke some other browser using the same technique and the outcome was ** CVE-2015-3753**.

The SOP-bypass for images works with Safari up to 8.0.7

We were able indeed to bypass the SOP for images served with 302 and with the data protocol (e.g. data:image/png;base64) and exfiltrate the image. You can find the detail of the issue in the mentioned blog post from Christian (our attack did not make use of the browser cache though)

Step to reproduce with Safari 8.0.7 :

Open the attacker page http://asanso.github.io/test.html username/password of the contained image are sop/sop

- click “exploit step 1” (this is just an intermediate step to load the image)
- click “exploit step 2” and appreciate the exfiltrated image in the alert message (substring) and the full one in the console (see also screenshot safari-sop.png)

The Tainted canvases export protection seems to be broken for the combination 302 + data.

Apple released security updates for Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8 and iOS 8.4.1 that address this and other issues.

Thanks goes to the Apple Product Security team.