CVE-2023-4357 PoC — Google Chrome 安全漏洞

Description

Network Security Project

介绍

# CVE-2023-4357-Exploitation
Network Security Project

### Description
Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page. 

### Reproduce

#### Set up the Environment

- Download Chrome on Linux

```bash!
$ wget https://edgedl.me.gvt1.com/edgedl/chrome/chrome-for-testing/114.0.5735.90/linux64/chrome-linux64.zip

$ unzip chrome-linux64.zip
```

- Execute

```bash!
$ ./chrome-linux64/chrome --no-sandbox
```

#### Start a Web Server

- prepare an SVG file to exploit the vulnerability
- prepare a bash script for starting the http server
- execute the script

```bash!
$ chmod +x start_server.sh

$ ./start_server.sh
```

#### Access the Browser
access the d.svg file on Chrome by navigating to localhost on port 8888

```bash
http://127.0.0.1:8888/d.svg
```

### Reference
- [link](https://github.com/xcanwin/CVE-2023-4357-Chrome-XXE)

文件快照

备注