Apple WebKit UXSS Vulnerability

Apple WebKit is the open source web browser engine. The "JSCallbackData" function in Apple WebKit has a UXSS issue that allows attackers to build malicious web pages and trick users into parsing them to execute arbitrary code...

WebKit: use-after-free in RenderLayer（CVE-2017-2455）

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the latest nightly build of WebKit. The PoC also crashes Safari 10.0.2 on Mac. PoC and ASan log follow PoC: function go div.style.setProperty"-webkit-flow-into", "foo"; document.execCommand"fontSize",...

Apple WebKit 10.0.2(12602.3.12.0.1) - Frame::setDocument (1) Universal Cross-Site Scripting Exploit

Exploit for multiple platform in category dos / poc && newDocument ASSERT!newDocument || newDocument-frame == this; if mdoc && mdoc-pageCacheState != Document::InPageCache mdoc-prepareForDestruction; mdoc = newDocument.copyRef; ... The function |prepareForDestruction| only called when the cache...

Apple WebKit - WebCore::toJS Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function freememory var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==25184==ERROR: AddressSanitizer: heap-use-after-free on...

WebKit: table use-after-free（CVE-2017-2471）

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on a nightly version of WebKit. The PoC has also been observed to crash Safari 10.0.3 on Mac. PoC: -webkit-border-image: urlfoo 1 5 1 63 repeat; -webkit-flow-into: foo function eventhandler var a;...

Apple Webkit - Universal Cross-Site Scripting by Accessing a Named Property from an Unloaded Window

Exploit for multiple platform in category web applications document auto& htmlDocument = downcastdocument; auto atomicPropertyName = propertyName.publicName; if atomicPropertyName && htmlDocument.hasWindowNamedItematomicPropertyName JSValue namedItem; if...

WebKit: Negative-size memmove in HTMLFormElement (CVE-2017-2459)

There is a negative-size memmove security vulnerability in WebKit. The vulnerability was confirmed on a nightly build of WebKit. The PoC has also been observed to crash Safari 10.0.2 on Mac. PoC Note: It might take a couple of refreshes to trigger the bug: function go var iframe =...

Apple WebKit 10.0.2(12602.3.12.0.1) - disconnectSubframes Universal Cross-Site Scripting Exploit

Exploit for multiple platform in category web applications frameOwners; if policy == RootAndDescendants if isroot frameOwners.appenddowncastroot; collectFrameOwnersframeOwners, root; // Must disable frame loading in the subtree so an unload handler cannot // insert more frames and create loaded...

Apple WebKit - ComposedTreeIterator::traverseNextInShadowTree Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function go d.open = false; d.innerHTML = "foo"; d.open = true; foo !-- ================================================================= ASan log: ================================================================= ==570==ERROR: AddressSanitizer:...

Apple WebKit - table Use-After-Free Exploit

Exploit for multiple platform in category dos / poc -webkit-border-image: urlfoo 1 5 1 63 repeat; -webkit-flow-into: foo function eventhandler var a; document.execCommand"selectAll", false; output.slot = "foo"; table.deleteCaption; //trigger garbage collector forvar i=0;i foo !--...

Apple WebKit - RenderLayer Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function go div.style.setProperty"-webkit-flow-into", "foo"; document.execCommand"fontSize", false, 6; window.requestAnimationFramecb; h1.attachShadowmode: "open"; h1.replaceWith"foo"; function cb var a; //trigger garbage collector forvar i=0;i...

WebKit: WebCore::toJS use-after-free（CVE-2017-2476）

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: function freememory var a; forvar i=0;i ASan log: ==25184==ERROR: AddressSanitizer: heap-use-after-free on address 0x61a000076e80 at pc 0x000115bea4e0 bp 0x7fff52cef2e...

WebKit: HTMLInputElement use-after-free (CVE-2017-2454)

There is a use-after-free security vulnerability related to how the HTMLInputElement is handled in WebKit. The vulnerability was confirmed on a nightly build of WebKit. The PoC also crashes Safari 10.0.2 on Mac. PoC: function eventhandler1 input.type = "foo"; function eventhandler2...

Apple WebKit 10.0.2(12602.3.12.0.1, r210800) - constructJSReadableStreamDefaultReader Type Confusion

Exploit for multiple platform in category web applications exec.argument0; if !stream return throwArgumentTypeErrorexec, scope, 0, "stream", "ReadableStreamReader", nullptr, "ReadableStream"; JSValue jsFunction = stream-get&exec, Identifier::fromString&exec, "getReader"; let rs = new...

WebKit: use-after-free in FormSubmission::create (CVE-2017-2460)

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on a nightly version of WebKit. The PoC has also been observed to crash Safari 10.0.2 on Mac. Please note: This bug is subject to a 90 day disclosure deadline. If 90 days elapse without a broadly available...

Apple WebKit - FormSubmission::create Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function go object.name = "foo"; input.autofocus = true; output.appendChildinput; form.submit; function eventhandler forvar i=0;i a !-- ================================================================= Preliminary analysis: The bug is in...

Apple Webkit - JSCallbackData Universal Cross-Site Scripting Exploit

Exploit for multiple platform in category web applications...

WebKit Denial of Service Vulnerability (CNVD-2017-05499)

WebKit is KDE, Apple Apple, Google Google and other companies to develop a set of open source Web browser engine , currently used by Apple Safari and Google Chrome and other browsers . WebKit suffers from a denial of service vulnerability. A remote attacker could exploit the vulnerability to caus...

WebKit: ComposedTreeIterator::traverseNextInShadowTree use-after-free（CVE-2017-2466）

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on a nightly version of WebKit. The PoC has also been observed to crash Safari 10.0.2 on Mac. PoC: function go d.open = false; d.innerHTML = "foo"; d.open = true; foo ASan log: ==570==ERROR:...

Apple WebKit 10.0.2 - HTMLInputElement Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function eventhandler1 input.type = "foo"; function eventhandler2 input.selectionStart = 25; !-- ================================================================= ASAN log from WebKit nightly on Mac:...