CVE-2021-1748 PoC — Apple iOS 输入验证错误漏洞

Source

https://github.com/ChiChou/mistune-patch-backport

Associated Vulnerability

Title: Apple iOS 输入验证错误漏洞 (CVE-2021-1748)
Description:A validation issue was addressed with improved input sanitization. This issue is fixed in tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted URL may lead to arbitrary javascript code execution.

Description

Backporting CVE-2021-1748 patch for iOS <=14.3

Readme

# CVE-2021-1748 Patch for iOS <= 14.3

The root cause of CVE-2021-1748 is that the app trusts arbitrary data URIs and loads them in a local WebView.

This tweak backports the patch for iOS <= 14.3 by intercepting `data:` URI.

Please note that there is still a powerful variant of bug. This patch doesn't stop server-side script injection or open-redirect on trusted domains.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →