CVE-2021-1748 PoC — Apple iOS 输入验证错误漏洞

Source

https://github.com/ChiChou/mistune-patch-backport

Associated Vulnerability

Title:Apple iOS 输入验证错误漏洞 (CVE-2021-1748)
Description:A validation issue was addressed with improved input sanitization. This issue is fixed in tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted URL may lead to arbitrary javascript code execution.

Description

Backporting CVE-2021-1748 patch for iOS <=14.3

Readme

# CVE-2021-1748 Patch for iOS <= 14.3

The root cause of CVE-2021-1748 is that the app trusts arbitrary data URIs and loads them in a local WebView.

This tweak backports the patch for iOS <= 14.3 by intercepting `data:` URI.

Please note that there is still a powerful variant of bug. This patch doesn't stop server-side script injection or open-redirect on trusted domains.

File Snapshot


 [4.0K]  /data/pocs/8d14cc1d44e0b14eff4446716c4f19d2d9449632
├── [ 241]  control
├── [  59]  itmsxssblock.plist
├── [1.0K]  LICENSE
├── [ 256]  Makefile
├── [ 375]  README.md
└── [ 221]  Tweak.x

0 directories, 6 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!