CVE-2011-0161 in iOS
Summary
by MITRE
WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle the Attr.style accessor, which allows remote attackers to bypass the Same Origin Policy and inject Cascading Style Sheets (CSS) token sequences via a crafted web site.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 01/26/2025
The vulnerability identified as CVE-2011-0161 represents a critical security flaw in WebKit-based browsers that affected Apple Safari versions prior to 5.0.4 and iOS versions before 4.3. This issue stems from improper handling of the Attr.style accessor within the WebKit rendering engine, creating a significant bypass mechanism for the fundamental Same Origin Policy that governs web browser security. The vulnerability operates at the core of browser security architecture where cross-origin restrictions are enforced to prevent malicious websites from accessing or manipulating resources from different domains.
The technical flaw manifests through the inadequate validation of CSS style attributes when accessed through the Attr.style accessor in WebKit. This improper handling allows attackers to craft malicious web pages that can inject CSS token sequences into the browser's rendering pipeline. The vulnerability specifically exploits how the browser processes style attribute access, creating a path for remote code execution through CSS manipulation. The flaw essentially enables attackers to circumvent the browser's security boundaries that normally prevent one website from accessing another website's resources, effectively breaking down the isolation mechanisms that protect user data and privacy.
The operational impact of this vulnerability extends beyond simple cross-origin data access, as it provides attackers with the capability to inject malicious CSS sequences that can manipulate the browser's rendering behavior. This injection capability can be leveraged to perform various malicious activities including but not limited to cross-site scripting attacks, data exfiltration, and potentially more sophisticated exploitation techniques. The vulnerability is particularly dangerous because it operates at the browser engine level, making it difficult to detect and mitigate through traditional web application security measures. Attackers can craft websites that appear benign but contain malicious CSS that exploits this flaw to gain unauthorized access to user sessions or sensitive information.
This vulnerability aligns with CWE-20, which describes improper input validation, and represents a classic example of how browser engine flaws can compromise core security models. The attack vector follows patterns consistent with the ATT&CK framework's T1059.006 technique for script injection and T1566 for social engineering through malicious websites. The vulnerability's exploitation requires minimal user interaction beyond visiting a malicious website, making it particularly dangerous in phishing campaigns or drive-by download scenarios. Organizations and users were advised to immediately update their browser versions to mitigate this risk, as the flaw existed in widely used platforms and affected millions of users who had not yet applied the necessary security patches. The incident highlighted the critical importance of browser security updates and the potential for engine-level vulnerabilities to create widespread security implications across multiple platforms and user bases.