Public Vulnerability Reports

Apple MobileSafari Attachment Viewing Cross Site Scripting Vulnerability

12.10.11

BACKGROUND

MobileSafari is Apple's mobile web browser for iOS devices. For more information about MobileSafari, please the visit following website:

http://www.apple.com/iphone/built-in-apps/safari.html

DESCRIPTION

Remote exploitation of a cross site scripting vulnerability in Apple Inc.'s MobileSafari could allow an attacker to view sensitive information in the context of the targeted domain.

This vulnerability occurs in MobileSafari's handling of the Content-Disposition header, which is typically used to inform the browser that an attachment is contained in the current response. Typical browser behavior is to prompt the user with an Open dialog, asking them how they would like to handle the attachment content (such as opening an external program). However, MobileSafari does not prompt the user, and instead opens the attached content in the browser. If an attacker can persuade a target to open an HTML attachment (such as by attaching an HTML file to an email), then this file will open in the context of the domain serving the file. This allows the HTML attachment full access to the DOM of the targeted domain, which can allow for cross site scripting.

ANALYSIS

Exploitation of this vulnerability results in the disclosure of potentially sensitive information, such as document cookies, on the target domain. To exploit this vulnerability, a targeted user must open an attachment from an affected domain. An attacker typically accomplishes this via social engineering or injecting content into compromised, trusted sites. Note that a user has to open an attachment, which takes at least one click; however, MobileSafari does not display an "Open" prompt dialog, so nothing beyond the initial click is necessary.

DETECTION

iOS versions prior to 5 are vulnerable.

WORKAROUND

iDefense is currently unaware of any workarounds for this issue.

VENDOR RESPONSE

Apple has released a fix which addresses this issue. Information about downloadable vendor updates can be found by clicking on the URLs shown.

http://lists.apple.com/archives/Security-announce/2011/Oct/msg00001.html

CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2011-3426 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems.

DISCLOSURE TIMELINE

03/02/2011 Initial Vendor Notification
03/02/2011 Vendor Reply
10/12/2011 Coordinated Public Disclosure

CREDIT

This vulnerability was reported to iDefense by Christian Matthies.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

LEGAL NOTICES

Copyright © 2011 Verisign, Inc.

Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customer service for permission.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.