Apple WebCore XMLHTTPRequest Cross-Site Scripting Vulnerability
BID:24598
Info
Apple WebCore XMLHTTPRequest Cross-Site Scripting Vulnerability
| Bugtraq ID: | 24598 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-2401 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 22 2007 12:00AM |
| Updated: | Aug 01 2007 06:55PM |
| Credit: | Richard Moore of Westpoint Ltd is credited with the discovery of this vulnerability. |
| Vulnerable: |
WebKit Open Source Project WebKit 0 Apple Safari 3.0.2 Beta for Windows Apple Safari 3.0.1 Beta for Windows Apple Safari 2.0.4 Apple Safari 2.0.3 Apple Safari 2.0.2 Apple Safari 2.0.1 Apple Safari 1.3.1 Apple Safari 1.3 Apple Safari 1.2.3 Apple Safari 1.2.2 Apple Safari 1.2.1 Apple Safari 1.2 Apple Safari 1.1 Apple Safari 1.0 Apple Safari 3 Beta for Windows Apple Safari 3 Beta Apple Mobile Safari 0 Apple iPhone 1 |
| Not Vulnerable: |
Apple iPhone 1.0.1 |
Discussion
Apple WebCore XMLHTTPRequest Cross-Site Scripting Vulnerability
Apple WebCore is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.
An attacker may exploit this issue by enticing victims into visiting a malicious website.
The attacker may leverage this issue to execute arbitrary script code in an application using the affected framework (typically Safari). This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Apple WebCore is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.
An attacker may exploit this issue by enticing victims into visiting a malicious website.
The attacker may leverage this issue to execute arbitrary script code in an application using the affected framework (typically Safari). This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Exploit / POC
Apple WebCore XMLHTTPRequest Cross-Site Scripting Vulnerability
An attacker can exploit this issue by enticing victims into visiting a malicious website.
The following example is available:
xmlhttp.setRequestHeader('Foo', 'baa\nHost: test\n');
The above request is treated as valid and results in:
GET / HTTP/1.1
Accept-Encoding: gzip, deflate
Accept-Language: en
Foo: baa
Host: test
An attacker can exploit this issue by enticing victims into visiting a malicious website.
The following example is available:
xmlhttp.setRequestHeader('Foo', 'baa\nHost: test\n');
The above request is treated as valid and results in:
GET / HTTP/1.1
Accept-Encoding: gzip, deflate
Accept-Language: en
Foo: baa
Host: test
Solution / Fix
Apple WebCore XMLHTTPRequest Cross-Site Scripting Vulnerability
Solution:
The vendor has provided fixes to address this issue. Please see the references for more information.
Apple security advisory APPLE-SA-2007-07-31 iPhone v1.0.1 Update is available.
Note that the iPhone update is available only through iTunes; it will not be available through the Software Update application or the Apple Downloads site. The update is automatically detected and downloaded by iTunes -- the user will be asked to install the update when the iPhone is docked.
Apple Safari 3.0.1 Beta for Windows
Solution:
The vendor has provided fixes to address this issue. Please see the references for more information.
Apple security advisory APPLE-SA-2007-07-31 iPhone v1.0.1 Update is available.
Note that the iPhone update is available only through iTunes; it will not be available through the Software Update application or the Apple Downloads site. The update is automatically detected and downloaded by iTunes -- the user will be asked to install the update when the iPhone is docked.
Apple Safari 3.0.1 Beta for Windows
-
Apple Safari302Beta.dmg
http://www.apple.com/safari/download/Safari302Beta.dmg -
Apple SafariSetup.exe
Safari 3 Beta Update 3.0.2 for Windows XP or Vista
http://www.apple.com/safari/download/SafariSetup.exe
References
Apple WebCore XMLHTTPRequest Cross-Site Scripting Vulnerability
References:
References: