{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5593","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5593/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5593/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5593/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/5593","id":90590765,"number":5593,"title":"Add module for CVE-2015-1155 OS X Safari vulnerability","user":{"login":"joevennix","id":648995,"avatar_url":"https://avatars.githubusercontent.com/u/648995?v=3","gravatar_id":"","url":"https://api.github.com/users/joevennix","html_url":"https://github.com/joevennix","followers_url":"https://api.github.com/users/joevennix/followers","following_url":"https://api.github.com/users/joevennix/following{/other_user}","gists_url":"https://api.github.com/users/joevennix/gists{/gist_id}","starred_url":"https://api.github.com/users/joevennix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joevennix/subscriptions","organizations_url":"https://api.github.com/users/joevennix/orgs","repos_url":"https://api.github.com/users/joevennix/repos","events_url":"https://api.github.com/users/joevennix/events{/privacy}","received_events_url":"https://api.github.com/users/joevennix/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/delayed","name":"delayed","color":"F5A9A9"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-06-24T07:15:16Z","updated_at":"2015-07-05T22:37:32Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/5593","html_url":"https://github.com/rapid7/metasploit-framework/pull/5593","diff_url":"https://github.com/rapid7/metasploit-framework/pull/5593.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/5593.patch"},"body":"This adds the module for exploiting CVE-2015-1155 in Mac OS X Safari, which allows UXSS, theft of cookie database, theft of arbitrary files, and silent installation of Safari extensions. I put the .webarchive generation logic into its own mixin, so that my updates can be ported back to the `apple_safari_webarchive_uxss`. This will be done in a subsequent PR.\r\n\r\nThe actual exploit can be observed in `safari_file_url_navigation.rb#popup_html`. By abusing a cross-domain `history.pushState` function, we can navigate a popup window to an arbitrary `file:// URL`. By mounting an FTP network drive containing a malicious webarchive file, all the crazy privileges given to a normal (unquarantined) webarchive file can be achieved.\r\n\r\nApple fixed this bug in May, and also added X-Frame-Options to extensions.apple.com. I've updated the module to work around this.\r\n\r\n#### Verification:\r\n- [ ] Exploit a vulnerable OSX Safari version (you have to click on the page once)\r\n- [ ] Cookie db is stolen\r\n- [ ] List of usernames is stolen\r\n- [ ] Any files in FILE_URLS are stolen\r\n- [ ] When INSTALL_EXTENSION is enabled, a Safari extension is silently installed"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/118672721","html_url":"https://github.com/rapid7/metasploit-framework/pull/5593#issuecomment-118672721","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5593","id":118672721,"user":{"login":"wchen-r7","id":1170914,"avatar_url":"https://avatars.githubusercontent.com/u/1170914?v=3","gravatar_id":"","url":"https://api.github.com/users/wchen-r7","html_url":"https://github.com/wchen-r7","followers_url":"https://api.github.com/users/wchen-r7/followers","following_url":"https://api.github.com/users/wchen-r7/following{/other_user}","gists_url":"https://api.github.com/users/wchen-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wchen-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wchen-r7/subscriptions","organizations_url":"https://api.github.com/users/wchen-r7/orgs","repos_url":"https://api.github.com/users/wchen-r7/repos","events_url":"https://api.github.com/users/wchen-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wchen-r7/received_events","type":"User","site_admin":false},"created_at":"2015-07-05T22:37:32Z","updated_at":"2015-07-05T22:37:32Z","body":"OK, I will try again. Thanks!"}}