full-disclosure - Re: [FDSA] Notepad Highly Critical Cross-Site Scripting (XSS) Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 17 Jan 2008 11:56:23 -0600
From: "Nate McFeters" <nate.mcfeters@...il.com>
To: "Fredrick Diggle" <fdiggle@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: [FDSA] Notepad Highly Critical Cross-Site
	Scripting (XSS) Vulnerability

Not to through fuel on the fire, but wouldn't that XSS actually be in IE,
since IE is what opens the file?  Could've been a funny joke though, a real
knee slapper.

Nate


On 1/17/08, Fredrick Diggle <fdiggle@...il.com> wrote:
>
> #######################################################################
>
>                             Fredrick Diggle Security Advisory
>
> Application: Notepad
> Versions: 5.1.2600.2180 verified to be vulnerable
> Platforms: Microsoft Windows (All Versions)
> Bugs: Cross Site Scripting (XSS)
> Severity: Critically High
> Date: 17 Jan 2008
> Credit: Estr Hinan
>
> #######################################################################
>
> 1) Introduction
> 2) Bugs
> 4) Fix
>
> #######################################################################
>
> ===============
> 1) Introduction
> ===============
>
> Fredrick Diggle Security Services is probably the best application
> security researchers on the scene this month. They have identified
> several hundred thousand vulnerabilities this week for which Priv8
> 0dayz have been developed. Fredrick Diggle Security Team periodically
> releases several of these vulnerabilities to the community at large
> (Pre Vendor Release!!!!). Fred Diggle would like to ensure that you
> understand this is 0DAY!!!. The vendors are completely unaware of this
> vulnerabilities.
>
> #######################################################################
>
> =======
> 2) Bug
> =======
>
> Notepad is a utility which is built into all current versions of
> Microsoft Windows. Notepad contains a highly exploitable stored
> cross-site scripting vulnerability when files are saved with the
> following extensions:
>
> htm
> html
>
> Other extensions may also be vulnerable in your environment depending
> on configuration. When arbitrary javascript code is entered into the
> notepad text window and saved using one of the vulnerable extensions a
> payload file is created. When an innocent user opens this payload file
> cross-site scripting occurs.
>
> #######################################################################
>
> =======
> 3) Proof of Concept
> =======
>
> 1. Open Notepad
> 2. Enter the following text
> <script>alert("xss");</script>
> 3. Save file as "exploit.html"
> 4. double click the payload file
>
> #######################################################################
>
> ======
> 4) Fix
> ======
>
> Notepad should be rewritten to filter potentially dangerous
> characters. Characters can be converted to their html encoded
> equivalents.
>
> #######################################################################
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/