{"vulnerability": "CVE-2011-3230", "sightings": [{"uuid": "ea636f0a-3f18-4292-ac3a-3f933465f38a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-3230", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:40.000000Z"}, {"uuid": "374cb152-5551-4b11-ab95-437494a35d83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-3230", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:08:56.000000Z"}, {"uuid": "47746373-ea5e-476c-923a-092c94bac577", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-3230", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/browser/safari_file_policy.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "b3828791-86aa-418a-bda3-892145743231", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2011-3230", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/17986", "content": "", "creation_timestamp": "2011-10-17T00:00:00.000000Z"}, {"uuid": "d741c1a2-3033-4ab1-a4bb-2026746b1a4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2011-3230", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/browser/safari_file_policy.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, java\", \"author\": [\"Aaron Sigel\", \"sinn3r \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a vulnerability found in Apple Safari on OS X platform.\\n          A policy issue in the handling of file:// URLs may allow arbitrary remote code\\n          execution under the context of the user.\\n\\n          In order to trigger arbitrary remote code execution, the best way seems to\\n          be opening a share on the victim machine first (this can be SMB/WebDav/FTP, or\\n          a file format that OS X might automount), and then execute it in /Volumes/[share].\\n          If there's some kind of bug that leaks the victim machine's current username,\\n          then it's also possible to execute the payload in /Users/[username]/Downloads/,\\n          or else bruteforce your way to getting that information.\\n\\n          Please note that non-java payloads (*.sh extension) might get launched by\\n          Xcode instead of executing it, in that case please try the Java ones instead.\", \"disclosure_date\": \"2011-10-12\", \"fullname\": \"exploit/osx/browser/safari_file_policy\", \"is_install_path\": true, \"mod_time\": \"2026-03-11 21:31:08 +0000\", \"name\": \"Apple Safari file:// Arbitrary Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/osx/browser/safari_file_policy.rb\", \"platform\": \"Java,OSX,Unix\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"osx/browser/safari_file_policy\", \"references\": [\"CVE-2011-3230\", \"OSVDB-76389\", \"URL-http://vttynotes.blogspot.com/2011/10/cve-2011-3230-launch-any-file-path-from.html#comments\", \"URL-http://support.apple.com/kb/HT5000\"], \"rport\": null, \"session_types\": false, \"targets\": [\"Safari 5.1 on OS X\", \"Safari 5.1 on OS X with Java\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:29.786547Z"}]}