Apple Safari file:// Arbitrary Code Execution

This module exploits a vulnerability found in Apple Safari on OSX platform. A policy issue in the handling of file:// URLs may allow arbitrary remote code execution under the context of the user. In order to trigger arbitrary remote code execution, the best way seems to be opening a share on the victim machine first (this can be SMB/WebDav/FTP, or a fileformat that OSX might automount), and then execute it in /Volumes/[share]. If there's some kind of bug that leaks the victim machine's current username, then it's also possible to execute the payload in /Users/[username]/Downloads/, or else bruteforce your way to getting that information. Please note that non-java payloads (*.sh extension) might get launched by Xcode instead of executing it, in that case please try the Java ones instead.

Search Other Modules

Exploit Rank

• Normal

Exploit Authors

• Aaron Sigel < >
• sinn3r < sinn3r [at] metasploit.com >

Vulnerability References

• CVE-2011-3230
• http://vttynotes.blogspot.com/2011/10/cve-2011-3230-launch-any-file-path-from...
• http://support.apple.com/kb/HT5000

Exploit Targets

• 0 - Safari 5.1 on OSX (default)
• 1 - Safari 5.1 on OSX with Java

Exploit Development

• Source Code
• History

Similar Exploit Modules

• exploit/osx/browser/mozilla_mchannel
• exploit/osx/browser/safari_libtiff
• exploit/osx/browser/safari_metadata_archive
• exploit/osx/browser/software_update

Exploit Usage Information

Exploit Module Options