{"uuid": "d741c1a2-3033-4ab1-a4bb-2026746b1a4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-3230", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/browser/safari_file_policy.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, java\", \"author\": [\"Aaron Sigel\", \"sinn3r \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a vulnerability found in Apple Safari on OS X platform.\\n          A policy issue in the handling of file:// URLs may allow arbitrary remote code\\n          execution under the context of the user.\\n\\n          In order to trigger arbitrary remote code execution, the best way seems to\\n          be opening a share on the victim machine first (this can be SMB/WebDav/FTP, or\\n          a file format that OS X might automount), and then execute it in /Volumes/[share].\\n          If there's some kind of bug that leaks the victim machine's current username,\\n          then it's also possible to execute the payload in /Users/[username]/Downloads/,\\n          or else bruteforce your way to getting that information.\\n\\n          Please note that non-java payloads (*.sh extension) might get launched by\\n          Xcode instead of executing it, in that case please try the Java ones instead.\", \"disclosure_date\": \"2011-10-12\", \"fullname\": \"exploit/osx/browser/safari_file_policy\", \"is_install_path\": true, \"mod_time\": \"2026-03-11 21:31:08 +0000\", \"name\": \"Apple Safari file:// Arbitrary Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/osx/browser/safari_file_policy.rb\", \"platform\": \"Java,OSX,Unix\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"osx/browser/safari_file_policy\", \"references\": [\"CVE-2011-3230\", \"OSVDB-76389\", \"URL-http://vttynotes.blogspot.com/2011/10/cve-2011-3230-launch-any-file-path-from.html#comments\", \"URL-http://support.apple.com/kb/HT5000\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Safari 5.1 on OS X\", \"Safari 5.1 on OS X with Java\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:29.786547Z"}