Re: New flaw found in Firefox 2.0.0.4: Firefox file input focus vulnerabilities

[Joseph Hick <leet16y () yahoo com>]

This doesn't seem like a security flaw to me.

<input type="file" id="file1" name="file1"
onkeydown="restore();" onkeyup="restore()" />
<label for="file1" id="label1" name="label1"></label>
<br>
<textarea name="text1" id="text1"
onkeydown="doKeyDown()">

function doKeyDown()
{
        document.getElementById("label1").focus();
}

onkeydown, you are focusing on label1 which is tied to
file1. so onkeydown, file1 gets focus. so the keyup
event happens on file1 which triggers restore().
restore() copies text1 into file1.

function restore()
{
        
document.getElementById("text1").value=document.getElementById("file1").value;
        document.getElementById("text1").focus();
}

so why is this a security flaw? could you please
explain?

--- carl hardwick <hardwick.carl () gmail com> wrote:

> PoC here:
> http://yathong.googlepages.com/FirefoxFocusBug.html
>
> The vulnerability allows the attacker to silently
> redirect focus of
> selected key press events to an otherwise protected
> file upload form
> field. This is possible because of how onKeyDown
> event is handled,
> allowing the focus to be moved between the two. This
> enables the
> attacker to read arbitrary files on victim's system.




 
____________________________________________________________________________________
The fish are biting. 
Get more visitors on your site using Yahoo! Search Marketing.
http://searchmarketing.yahoo.com/arp/sponsoredsearch_v2.php

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/