CVE-2012-10032
HIGHMaxthon3 < 3.2.2 build 1000 - Cross-Context Scripting via about:history Page
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2012-10032.
PoCs published by Metasploit, Roberto Suggi Liverani, sinn3r, juan vazquez, including Metasploit module exploits/windows/browser/maxthon_history_xcs.
AI-analyzed exploit summary This Metasploit module exploits a Cross-Context Scripting (XCS) vulnerability in Maxthon 3's about:history page to execute arbitrary commands. It leverages the trusted zone to modify settings and achieve RCE via the Program DOM API.
Description
Maxthon3 version 3.2.2 build 1000 and prior are vulnerable to cross context scripting (XCS) via the about:history page. The browser’s trusted zone improperly handles injected script content, allowing attackers to execute arbitrary JavaScript in a privileged context. This flaw enables modification of browser configuration and execution of arbitrary code through Maxthon’s exposed DOM APIs, including maxthon.program.Program.launch() and maxthon.io.writeDataURL(). Exploitation requires user interaction, typically by visiting a malicious webpage that triggers the injection.
Exploits (2)
This Metasploit module exploits a Cross-Context Scripting (XCS) vulnerability in Maxthon 3's about:history page to execute arbitrary commands. It leverages the trusted zone to modify settings and achieve RCE via the Program DOM API.
This Metasploit module exploits a Cross-Context Scripting (XCS) vulnerability in Maxthon3's about:history page to execute arbitrary commands by injecting malicious JavaScript into a trusted browser zone. It leverages Maxthon's Program DOM API to write and execute a payload on the target system.
References (6)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X