Firefox 1.5 allow cross-domain posting to secured pages

[lists <lists () mccanless us>]

I reported this to Bugzilla over a year ago (256202) but looks like they don't plan on fixing it....

If a form attempts to post data to a site that is secured by basic auth and the site is outside the current domain, 
then Firefox dutifully alerts you that an attempt is being made at cross-domain posting.  

Example 1: 

You are at site www.abc.com and a form attempts to post form data  to www.123.com which is secured by basic 
authorization. Using a URL in the form of username:password () 123 com, Firefox alerts you.

However, just drop a hidden IFRAME in the form, set its src to username:password () 123 com and Firefox is fooled into 
thinking that it is not a cross-domain posting.  So no warning pops up.  You can also drop the U/P on the URL in the 
forms action since the IFRAME has already logged in.

While there are probably lots of annoying things that can arise from this, one novel exploit came to mind.  Since so 
many users never change the default password for home routers and since routers use basic authentication for logins, 
you could devise a form that changes router settings of a user and that user is never notified.  One could easily 
create a simple html page that has a form that posts form data to a common IP for home routers using the default U/P.  
This could be used to turn off the firewall or turn on remote management.  Then just log the IP's of visitors and write 
a script to test if it worked.  I tested this on some of the most common routers with  Firefox 1.5 and it works like a 
charm with no notification to the user.  

Hopefully, Firefox will fix this now that is has been posted.










_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/