bugtraq - Apple Safari on MacOSX may reveal user's saved passwords

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: 14 May 2007 13:50:53 -0000
From: poplix@...usia.org
To: bugtraq@...urityfocus.com
Subject: Apple Safari on MacOSX may reveal user's saved passwords

hello,
Apple Safari on Macosx may reveal user's saved passwords. A local user with legitimate access to the system is able to steal keychained password by injecting javascripts into a loaded webpage via applescript.
It seems that safari fails to validate the source of injected code, however apple belives this is the correct behaviour so no fixes will be made available.

this proof of concept scpt file will display the password loaded by safari into an html object named "password":

tell application "Safari"
	do JavaScript "alert(document.loginform.password.value)" in document 1
end tell

comments are welcome

cheers,
-poplix
http://px.dynalias.org