{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5188","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5188/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5188/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5188/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/5188","id":69339009,"number":5188,"title":"Add Cookie Disclosure module for iOS 8.3 Safari and OSX Safari 8.0.4","user":{"login":"joevennix","id":648995,"avatar_url":"https://avatars.githubusercontent.com/u/648995?v=3","gravatar_id":"","url":"https://api.github.com/users/joevennix","html_url":"https://github.com/joevennix","followers_url":"https://api.github.com/users/joevennix/followers","following_url":"https://api.github.com/users/joevennix/following{/other_user}","gists_url":"https://api.github.com/users/joevennix/gists{/gist_id}","starred_url":"https://api.github.com/users/joevennix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joevennix/subscriptions","organizations_url":"https://api.github.com/users/joevennix/orgs","repos_url":"https://api.github.com/users/joevennix/repos","events_url":"https://api.github.com/users/joevennix/events{/privacy}","received_events_url":"https://api.github.com/users/joevennix/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-04-18T19:21:51Z","updated_at":"2015-04-19T05:55:42Z","closed_at":"2015-04-19T05:55:42Z","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5188","html_url":"https://github.com/rapid7/metasploit-framework/pull/5188","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5188.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5188.patch"},"body":"Patched and disclosed April 8th: http://seclists.org/fulldisclosure/2015/Apr/30\r\n\r\nThe issue involves handling of an encoded username in an FTP URL. From the sound of it, all versions ever are affected, including Windows.\r\n\r\n#### Verification\r\n- [ ] Execute some code in the context of other domains:\r\n\r\n        msf> use auxiliary/gather/apple_safari_ftp_url_uxss\r\n        msf> set TARGET_DOMAINS apple.com,google.com,example.com\r\n        msf> set CUSTOM_JS alert(document.domain)\r\n        msf> run\r\n\r\n\r\n\r\n- [ ] Browse to the output URL. You should get three popups, one for each domain listed.\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/94242237","html_url":"https://github.com/rapid7/metasploit-framework/pull/5188#issuecomment-94242237","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5188","id":94242237,"user":{"login":"joevennix","id":648995,"avatar_url":"https://avatars.githubusercontent.com/u/648995?v=3","gravatar_id":"","url":"https://api.github.com/users/joevennix","html_url":"https://github.com/joevennix","followers_url":"https://api.github.com/users/joevennix/followers","following_url":"https://api.github.com/users/joevennix/following{/other_user}","gists_url":"https://api.github.com/users/joevennix/gists{/gist_id}","starred_url":"https://api.github.com/users/joevennix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joevennix/subscriptions","organizations_url":"https://api.github.com/users/joevennix/orgs","repos_url":"https://api.github.com/users/joevennix/repos","events_url":"https://api.github.com/users/joevennix/events{/privacy}","received_events_url":"https://api.github.com/users/joevennix/received_events","type":"User","site_admin":false},"created_at":"2015-04-19T05:55:41Z","updated_at":"2015-04-19T05:55:41Z","body":"oops, I totally misread the advisory. This just discloses non-HTTPOnly cookies, and is not a full uxss (since attacker can only access resources from the ftp:// scheme). I'll update this tomorrow with the relevant code.\r\n"}}