CVE-2017-7037

published 2017-07-20

CVE-2017-7037: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected…

Priority P2 64 high 8.8 CVSS 3.0

AV N AC L PR N UI R S U C H I H A H

EXPLOIT

An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
apple	icloud	< 6.2.2	6.2.2
apple	icloud_for_windows	—	—
apple	ios	—	—
apple	iphone_os	< 10.3.3	10.3.3
apple	itunes	< 12.6.2	12.6.2
apple	itunes_12.6.2_for_windows	—	—
apple	safari	< 10.1.2	10.1.2
apple	safari	—	—
apple	tvos	< 10.2.2	10.2.2
apple	tvos	—	—
debian	webkit2gtk	< webkit2gtk 2.16.6-1 (bookworm)	webkit2gtk 2.16.6-1 (bookworm)

Detection & IOCs extracted from sources · hover to see the quote

command arguments.callee.caller.constructor('alert(location)')()↗

command Object.prototype.__defineSetter__('test', v => { 'a' + v; });↗

• → The exploit abuses JSObject::putInlineSlow / JSValue::putToPrimitive in WebKit JSC to achieve Universal XSS by manipulating __proto__ of a primitive (number) to point to a cross-origin iframe's contentWindow, then triggering a setter via Object.prototype.__defineSetter__. ↗
• → Exploit pattern: an iframe is created with a data: URI containing a malicious __defineSetter__ on Object.prototype, and the parent frame sets __proto__ of a primitive or plain object to the iframe's contentWindow to escape the same-origin policy. ↗
• → Detect use of data: URI iframes combined with cross-origin prototype chain manipulation (__proto__ assignment to contentWindow) in JavaScript — a strong indicator of this UXSS exploit pattern. ↗
• → Trigger condition: processing maliciously crafted web content in WebKit leads to memory corruption and arbitrary code execution; monitor WebKit-based browsers/apps crashing on untrusted web content. ↗

• · This vulnerability affects multiple Apple product lines; patched versions are iOS 10.3.3, Safari 10.1.2, iCloud for Windows 6.2.2, iTunes for Windows 12.6.2, and tvOS 10.2.2. Detection should cover all WebKit-based surfaces across these products. ↗
• · On Debian-based Linux systems (webkit2gtk), the vulnerability is resolved in version 2.16.6-1 across all tracked branches (bookworm, bullseye, forky, sid, trixie). ↗

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

osv 8.8 HIGH

vendor_debian 8.8 LOW

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119