CVE-2009-1699
HIGHApple Safari < 4.0 - XML External Entity Injection via XSL Stylesheet
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2009-1699. PoCs published by Chris Evans.
AI-analyzed exploit summary This exploit demonstrates an XXE (XML External Entity) attack in Safari prior to version 4, allowing a malicious webpage to steal local files by embedding a crafted XSL stylesheet with a DTD that references a local file (e.g., /etc/passwd). The attack leverages the browser's XML parsing and XSL transformation to exfiltrate file contents.
Description
The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a file:///etc/passwd URL in an entity declaration, related to an "XXE attack."
Exploits (2)
This exploit demonstrates an XXE (XML External Entity) attack in Safari prior to version 4, allowing a malicious webpage to steal local files by embedding a crafted XSL stylesheet with a DTD that references a local file (e.g., /etc/passwd). The attack leverages the browser's XML parsing and XSL transformation to exfiltrate file contents.
This exploit demonstrates an XXE (XML External Entity) attack against WebKit in Safari prior to version 4, allowing an attacker to steal local files by crafting a malicious XSL stylesheet and XML file. The PoC includes a sample XSL file that attempts to read /etc/passwd and display its contents via JavaScript.
References (17)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N