hello,
Apple Safari on Macosx may reveal user's saved passwords. A local user with
legitimate access to the system is able to steal keychained password by
injecting javascripts into a loaded webpage via applescript.
It seems that safari fails to validate the source of injected code, however
apple belives this is the correct behaviour so no fixes will be made available.
this proof of concept scpt file will display the password loaded by safari into
an html object named "password":
tell application "Safari"
do JavaScript "alert(document.loginform.password.value)" in document 1
end tell
comments are welcome
cheers,
-poplix
http://px.dynalias.org
