Bugtraq mailing list archives
Re: Internet Explorer URL parsing vulnerability
From: Nick FitzGerald <nick () virus-l demon co uk>
Date: Wed, 10 Dec 2003 11:10:26 +1300
<bugtraq () zapthedingbat com> wrote:
By opening a window using the http://user@domain nomenclature an attacker can hide the real location of the page by including a 0x01 character after the "@" character. ...
"before" methinks (as in your example!).
... Internet Explorer doesn't display the rest of the URL making the page appear to be at a different domain. # POC ########## http://www.zapthedingbat.com/security/ex01/vun1.htm
In fact, it seems that the URL-encoding is unnecessary (although how reliably a page with an 0x01 character in it will be transported around I'm not sure and it would likely be less useful for attempted exploits transmitted via Email). So, anyone busily setting up further filters in any sanitizing procedures for incoming HTML should not only be looking for "%01" but straight 0x01 characters (although reliably interpreting this when combined with scripting -- see below -- might be a headache). Oddly (or not, depending on your experience with, and expectations of, inconsistencies in MS products) this does not seem to work in a straight http-equiv=refresh situation. Odder yet (or not, depending on your experience with, and expectations of, inconsistencies in MS products) it does work with http-equiv=refresh if you script the writing of the refresh statement. Go figure! I don't have ready access to a suitable server config at the moment to try the variations with server-side redirects -- anyone?? Regards, Nick FitzGerald
Current thread:
- Internet Explorer URL parsing vulnerability bugtraq (Dec 09)
- Re: Internet Explorer URL parsing vulnerability Nick FitzGerald (Dec 10)
- Re: Internet Explorer URL parsing vulnerability nesumin (Dec 23)
- <Possible follow-ups>
- Re: Internet Explorer URL parsing vulnerability soulshok (Dec 09)
- Message not available
- Re: Internet Explorer URL parsing vulnerability Eric "MightyE" Stevens (Dec 09)
- Message not available
- Internet Explorer URL parsing vulnerability John W. Noerenberg II (Dec 09)
- Re: Internet Explorer URL parsing vulnerability Pedro Castro (Dec 10)
- Re: Internet Explorer URL parsing vulnerability William Stockall (Dec 10)
- Re: Internet Explorer URL parsing vulnerability Andreas Plesner Jacobsen (Dec 10)
- Re: Internet Explorer URL parsing vulnerability Charles Richmond (Dec 11)
- Re: Internet Explorer URL parsing vulnerability Tiago Pierezan Camargo (Dec 10)
- Re: Internet Explorer URL parsing vulnerability Pedro Castro (Dec 10)