Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Macintosh :: tb10883.htm

Apple Safari on MacOSX may reveal user's saved passwords



Apple Safari on MacOSX may reveal user's saved passwords
Apple Safari on MacOSX may reveal user's saved passwords



hello,
Apple Safari on Macosx may reveal user's saved passwords. A local user with legitimate access to the system is able to steal keychained password by injecting javascripts into a loaded webpage via applescript.
It seems that safari fails to validate the source of injected code, however apple belives this is the correct behaviour so no fixes will be made available.


this proof of concept scpt file will display the password loaded by safari into an html object named "password":

tell application "Safari"
	do JavaScript "alert(document.loginform.password.value)" in document 1
end tell


comments are welcome

cheers,
-poplix
http://px.dynalias.org 


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH