Exploit for Apple Safari libxslt File Create

CVE-2011-1774

saint · 2011-10-24

Description

Apple Safari libxslt File Create CVE-2011-1774 BID: 4884

Entry point

ParameterREMOTE_PATH · path

Pathflag.txt

XSLT payload delivered via HTTP to drop a file on the target filesystem using WebKit XSLT vulnerability (CVE-2011-1774).

Affected Apple Safari versions

Apple Safari≤ 5.0.5, 1.0, 1.0.0, 1.0.0b1, 1.0.0b2, 1.0.1, 1.0.2, 1.0.3, 1.1, 1.1.0, 1.1.1, 1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.3, 1.3.0, 1.3.1, 1.3.2, 2, 2.0, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 3, 3.0, 3.0.0, 3.0.0b, 3.0.1, 3.0.1b, 3.0.2, 3.0.2b, 3.0.3, 3.0.3b, 3.0.4

All known vulnerabilities by product

Suse Linux Enterprise Safari Webkit Libxslt

CVSS 8.8 for CVE-2011-1774

8.8

HIGH SEVERITY

Version 2.0

VectorAV:N/AC:M/Au:N/C:N/I:C/A:C

EPSS Score

43.2%higher than 98.6% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2011-10-24 00:00

Last Seen:2025-06-26 10:10

Reporter:SAINT Corporation

Other exploits for CVE-2011-1774

Cross Platform Webkit File Dropper

2024-08-31 Jay Turla, metasploit.comPACKETSTORMRuby

Apple Safari libxslt File Create

2011-10-24 SAINT CorporationSAINT

Apple Safari libxslt File Create

2011-10-24 SAINT CorporationSAINT

Apple Safari libxslt File Create

2011-10-24 SAINT CorporationSAINT

Apple Safari Webkit - libxslt Arbitrary File Creation (Metasploit)

2011-10-18 MetasploitEXPLOITDBRuby

Cross Platform Webkit File Dropper

2011-10-18 Nicolas GregoireMETASPLOITRuby

Apple Safari Webkit libxslt Arbitrary File Creation

2011-10-18 Nicolas GregoireMETASPLOITRuby

Apple Safari Webkit libxslt Arbitrary File Creation

2011-10-18 Nicolas GregoirePACKETSTORMRuby

Exploit Code

MARKDOWN33 lines

## https://sploitus.com/exploit?id=SAINT:CED64EBA3D2566CEFFC00E9500406AF4
Added: 10/24/2011  
CVE: CVE-2011-1774  
BID: 48840  
OSVDB: 74017  


### Background

Safari is a web browser for Mac OS X and Windows. 

### Problem

Safari versions prior to 5.0.6 use unsafe security settings when implementing libxslt. An attacker may leverage this weakness by creating a web page that references a malicious XSLT file. If loaded in a vulnerable Safari client, the attacker may be able to cause the browser to download, save and execute any file of their choice. 

### Resolution

Upgrade to Apple Safari 5.0.6 or later. 

### References

http://support.apple.com/kb/HT4808   


### Limitations

This exploit has been tested against Apple Safari 5.0.5 on Windows XP SP3 English (DEP OptIn).  
The payload will not be executed until the next successful login.  
The target must be able to connect to an HTTP server running on the SAINT Exploit host. This service listens on port 8000 by default. 

### Platforms

Windows

Exploit Code

Share

Share on social media: