Apple WebKit disconnectSubframes UXSS

Apple WebKit: UXSS via disconnectSubframes CVE-2017-2445 When an element is removed from a document, the function |disconnectSubframes| is called to detach its subframesiframe tag, object tag, etc.. Here is a snippet of |disconnectSubframes|. void disconnectSubframesContainerNode& root,...

WebKit Table Use-After-Free

WebKit: table use-after-free CVE-2017-2471 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on a nightly version of WebKit. The PoC has also been observed to crash Safari 10.0.3 on Mac. PoC: ===============================================================...

WebKit constructJSReadableStreamDefaultReader Type Confusion

WebKit: Type confusion in constructJSReadableStreamDefaultReader CVE-2017-2457 EncodedJSValue JSCHOSTCALL constructJSReadableStreamDefaultReaderExecState& exec VM& vm = exec.vm; auto scope = DECLARETHROWSCOPEvm; JSReadableStream stream = jsDynamicDowncastexec.argument0; if !stream return...

WebKit HTMLInputElement Use-After-Free

WebKit: HTMLInputElement use-after-free CVE-2017-2454 There is a use-after-free security vulnerability related to how the HTMLInputElement is handled in WebKit. The vulnerability was confirmed on a nightly build of WebKit. The PoC also crashes Safari 10.0.2 on Mac. PoC:...

WebKit FormSubmission::create Use-After-Free

WebKit: use-after-free in FormSubmission::create CVE-2017-2460 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on a nightly version of WebKit. The PoC has also been observed to crash Safari 10.0.2 on Mac. Please note: This bug is subject to a 90 day...

WebKit HTMLFormElement Negative-Size Memmove

WebKit: Negative-size memmove in HTMLFormElement CVE-2017-2459 There is a negative-size memmove security vulnerability in WebKit. The vulnerability was confirmed on a nightly build of WebKit. The PoC has also been observed to crash Safari 10.0.2 on Mac. PoC Note: It might take a couple of refresh...

Apple WebKit JSCallbackData UXSS

Apple Webkit: UXSS with JSCallbackData CVE-2017-2442 Here is the definition of |JSCallbackData| class. This class is used to call a javascript function from a DOM object. class JSCallbackDataStrong : public JSCallbackData public: JSCallbackDataStrongJSC::JSObject callback, void :...

WebKit JSC::B3::Procedure::resetReachability Use-After-Free

WebKit: Use-after-free in JSC::B3::Procedure::resetReachability CVE-2017-2470 Note: It seems it doesn't crash the JSC compiled without Address Sanitizer. PoC: function for var i = 0; i 1000000; ++i const v = Array & 1 ? v : 1; typeof o = 'object'; ; Asan Log:...

WebKit JSC::SymbolTableEntry::isWatchable Heap Buffer Overflow

WebKit: heap-buffer-overflow in JSC::SymbolTableEntry::isWatchable CVE-2017-2469 I confirmed the PoC crashes the release version of Safari 10.0.312602.4.8. It might need to refresh the page several times. PoC: function x = 0 var a; function arguments function b var g = 1; a5; f; g; ; Asan Log:...

Apple Webkit Named Property UXSS

Apple Webkit: UXSS by accessing a named property from an unloaded window CVE-2017-2367 The frame is not detached from an unloaded window. We can access to the new document's named properties via the following function. static bool...

WebKit ComposedTreeIterator::traverseNextInShadowTree Use-After-Free

WebKit: ComposedTreeIterator::traverseNextInShadowTree use-after-free CVE-2017-2466 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on a nightly version of WebKit. The PoC has also been observed to crash Safari 10.0.2 on Mac. PoC:...

Apple WebKit Frame::setDocument UXSS

Apple WebKit: UXSS via Frame::setDocument 1. CVE-2017-2364 void Frame::setDocumentRefPtr&& newDocument ASSERT!newDocument || newDocument-frame == this; if mdoc && mdoc-pageCacheState != Document::InPageCache mdoc-prepareForDestruction; mdoc = newDocument.copyRef; ... The function...

WebKit RenderLayer Use-After-Free

WebKit: use-after-free in RenderLayer CVE-2017-2455 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the latest nightly build of WebKit. The PoC also crashes Safari 10.0.2 on Mac. PoC and ASan log follow PoC:...

WebKit Document::adoptNode Use-After-Free

WebKit: Use-After-Free via Document::adoptNode CVE-2017-2468 This is a regression test from: https://crbug.com/541206. But I think it seems not possible to turn it into an UXSS in WebKit. PoC: var s = document.body.appendChilddocument.createElement'script'; s.type = '0'; s.textContent =...

Multiple Apple Products WebKit Component Code Execution Vulnerability

AppleiOS, Safari, and tvOS are products of Apple Inc. AppleiOS is an operating system developed for mobile devices; Safari is a web browser that is the default browser that comes with the MacOSX and iOS operating systems; and tvOS is an operating system for smart TVs. webKit is an open source web...

Cross-site scripting vulnerability in WebKit component of multiple Apple products

AppleiOS, Safari, and tvOS are products of Apple Inc. AppleiOS is an operating system developed for mobile devices; Safari is a web browser that is the default browser that comes with the MacOSX and iOS operating systems; and tvOS is an operating system for smart TVs. webKit is an open source web...

Sony Playstation 4 (PS4) 3.50 4.07 - WebKit Code Execution (PoC)

Sony Playstation 4 PS4 3.50 4.07 - WebKit Code Execution PoC PS4 4.0x Code Execution ============== This repo is my edit of the 4.0x webkit exploit released by qwertyoruiopz. The edit re-organizes, comments, and adds portability across 3.50 - 4.07 3.50, 3.55, 3.70, 4.00, and of course 4.06/4.07...

Apple iOS webkit memory corruption vulnerability (CNVD-2017-05602)

Apple iOS is an operating system for Apple smart devices. A memory corruption vulnerability exists in Webkit used by Apple iOS, which allows attackers to exploit the vulnerability to build malicious web pages that can be clicked on by users, which can crash the application or execute arbitrary co...

Apple iOS webkit memory corruption vulnerability (CNVD-2017-05607)

Apple iOS is an operating system for Apple smart devices. A memory corruption vulnerability exists in Webkit used by Apple iOS, which allows attackers to exploit the vulnerability to build malicious web pages that can be clicked on by users, which can crash the application or execute arbitrary co...

Apple iOS webkit memory corruption vulnerability (CNVD-2017-05606)

Apple iOS is an operating system for Apple smart devices. A memory corruption vulnerability exists in Webkit used by Apple iOS, which allows attackers to exploit the vulnerability to build malicious web pages that can be clicked on by users, which can crash the application or execute arbitrary co...