Vulners
Lucene search
WebKit - ContainerNode::parserInsertBefore Universal Cross-Site Scripting Exploit
| Reporter | Title | Published | Views | Family All 24 |
|---|---|---|---|---|
 | Apple iOS < 10.3.2 Multiple Vulnerabilities | 17 May 201700:00 | – | nessus |
| Safari < 10.1.1 Multiple Vulnerabilities | 18 May 201700:00 | – | nessus |
| Apple iOS < 10.3.2 Multiple Vulnerabilities | 18 May 201700:00 | – | nessus |
| GLSA-201706-15 : WebKitGTK+: Multiple vulnerabilities | 8 Jun 201700:00 | – | nessus |
| macOS : Apple Safari < 10.1.1 Multiple Vulnerabilities | 23 May 201700:00 | – | nessus |
| Linux Distros Unpatched Vulnerability : CVE-2017-2508 | 24 Aug 202500:00 | – | nessus |
 | About the security content of iOS 10.3.2 | 15 May 201700:00 | – | apple |
| About the security content of Safari 10.1.1 | 15 May 201700:00 | – | apple |
| About the security content of iOS 10.3.2 - Apple Support | 20 Jun 201710:37 | – | apple |
| About the security content of Safari 10.1.1 - Apple Support | 26 Jun 201704:38 | – | apple |
10
Sources:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1146
https://bugs.chromium.org/p/chromium/issues/detail?id=519558
VULNERABILITY DETAILS
From /WebKit/Source/core/dom/ContainerNode.cpp:
----------------
void ContainerNode::parserInsertBefore(PassRefPtrWillBeRawPtr<Node> newChild, Node& nextChild)
{
(...)
while (RefPtrWillBeRawPtr<ContainerNode> parent = newChild->parentNode())
parent->parserRemoveChild(*newChild);
if (document() != newChild->document())
document().adoptNode(newChild.get(), ASSERT_NO_EXCEPTION);
{
EventDispatchForbiddenScope assertNoEventDispatch;
ScriptForbiddenScope forbidScript;
treeScope().adoptIfNeeded(*newChild);
insertBeforeCommon(nextChild, *newChild);
newChild->updateAncestorConnectedSubframeCountForInsertion();
ChildListMutationScope(*this).childAdded(*newChild);
}
notifyNodeInserted(*newChild, ChildrenChangeSourceParser);
}
----------------
|parserRemoveChild| can run script, and it can remove |nextChild| from DOM or move the node around. When this happens, the tree will be in an inconsistent state after the |insertBeforeCommon| call, allowing an attacker to bypass the frame restrictions.
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/42066.zip
# 0day.today [2018-03-05] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
25 May 2017 00:00Current
7.6High risk
Vulners AI Score7.6
EPSS0.01026