Other nomination

Launch any file path from web page

Aaron Sigel

A web page could hand any file: URL to Mac OS X LaunchServices through document.location, which then runs the binary, opens the application, or opens the file in its default handler. Only the quarantine bit stops a freshly downloaded binary, so anything already on disk launches. Apple fixed it in HT5000 as CVE-2011-3230.

Record

Researcher

Aaron Sigel

Format

Advisory

In the archive

• Nominated for the 2011 Top 10 Web Hacking Techniques

Tags

• cve
• vendor-advisory
• rce
• javascript
• url-parsing

This page is the archive's own catalogue record. The research is the work of Aaron Sigel, first published at the original source. Preserved copies are kept so the citation survives its host.