Write-up: Address bar spoofing in Mobile Safari (CVE-2012-0674)

Summary. Mobile Safari on iOS 5.1 (AppleWebKit/534.46) mishandled URLs opened with JavaScript's window.open(), so the address bar could show one URL while the content came from a different origin. That made convincing address-bar spoofing possible, for example framing apple.com inside an attacker page while the bar read apple.com. Assigned CVE-2012-0674 and fixed by Apple in iOS 5.1.1.

Background

I discovered an address bar spoofing vulnerability in Apple Mobile Safari (AppleWebKit/534.46) running on iOS 5.1. The issue was later assigned CVE-2012-0674 and fixed by Apple.

The weakness was caused by an error in how URLs were handled when using JavaScript's window.open() method. It could be exploited to trick users into disclosing sensitive information to a malicious site, because the address bar could be made to display one URL while the content shown actually came from another origin.

Steps to reproduce

1) Visit https://window.name/html5/ios51-demo.html with Safari on iOS 5.1

2) Click the "demo" button

3) Safari opens a new window showing "http://www.apple.com" in the address bar,
   while "http://www.apple.com" is in fact displayed inside an iframe within
   the host https://window.name

4) Because the address bar shows "http://www.apple.com", the user believes they
   are visiting apple.com while they are still on the attacker's website.

Impact

Because the displayed address could be fully controlled while the content came from another origin, a visitor had no reliable way to tell which site they were actually on. That is the foundation for credible phishing: the page can present a trusted site's login form under its own name.

Timeline

2012-03-01: vulnerability identified on iOS 5.0
2012-03-01: vulnerability reproduced on iOS 5.1
2012-03-02: vendor informed
2012-03-03: vendor response
2012-03-20: advisory published with partial details
2012-05-07: vendor releases patch in iOS 5.1.1
2012-05-08: advisory published with full details and proof of concept

References

• CVE record: CVE-2012-0674 (NVD)