Skip to main content

Posts

Showing posts from August, 2015

Apple Safari SOP bypass (CVE-2015-3753)

Damien Antipa and me love browser security.
Hence we always keep up to date on what is going on this field.
Few months ago Christian Schneider blogged about Chrome SOP Bypass with SVG. We decided to poke some other browser using the same technique and the outcome was CVE-2015-3753.

The SOP-bypass for images works with Safari up to 8.0.7

We were able indeed to bypass the SOP for images served with 302 and with the data protocol (e.g. data:image/png;base64) and exfiltrate the image. You can find the detail of the issue in the mentioned blog post from Christian (our attack did not make use of the browser cache though)

Step to reproduce with Safari 8.0.7 :

Open the attacker page http://asanso.github.io/test.htmlusername/password of the contained image are sop/sop

- click "exploit step 1" (this is just an intermediate step to load the image)
- click "exploit step 2" and appreciate the exfiltrated image in the alert message (substring) and the full one in the console…