lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 12 Dec 2006 12:01:02 +1300
From: "Brett Moore" <>
To: <>
Subject: [SBDA] SiteKiosk - FileSystem Access

Still time before Christmas.

= SiteKiosk - FileSystem Access
= Vendor Website:  
= Affected Software:
=       SiteKiosk < 6.5.150
= Public disclosure on Tuesday December 12, 2006

== Overview ==

SiteKiosk is an application used to secure public access terminals. It
designed to provide a safe and stable way for the use of public access 
terminals with or without access to the Internet.

SiteKiosk is based on Internet Explorer and can be configured to 
individually restrict access to Web sites, the operating system, 
system settings, and applications. Your computer will be protected
any manipulation from the time you boot until you shut it down. 

SiteKiosk suffers from a cross site scripting vulnerability, that leads
to filesystem access.

== Exploitation ==

SiteKiosk implements a 'skinning' feature so that the layout and display

of the browser can be modified. The 'skinning' feature uses an HTML
control for the modified title bar of the main SiteKiosk window.

SiteKiosk displays the URL of the current location in the title bar of 
the main window, and therefore any HTML code in the location will be 
included in the title bar.

By default, SiteKiosk does not properly handle the ABOUT: prefix. The
is directly outputted to the screen leading to a normal cross site

Because the URL is also outputted to the title bar, script can be
under the LOCAL computer zone. 

If a user types the following into the address box, or browses a site
sets the location to; ABOUT:hello<a href=\>click here</a> 

The title bar will display a hyperlink. By clicking on this HREF in the 
main windows title bar, the filesystem will be accessed with an explorer

SiteKiosk also installs some activeX controls that are marked 'safe
for scripting'. One of these controls exposes two dangerous methods that
allow a SiteKiosk user to read and download any file from the kiosk
with the permissions of the user running SiteKiosk.

== Solutions ==

A new version of SiteKiosk has been released that addresses these
vulnerabilities. It can be downloaded from

== Credit ==

Discovered and advised to SiteKiosk November 30, 2006 by Brett Moore of

== About == is Australasia's leading team of Information 
Security consultants specialising in providing high quality Information 
Security services to clients throughout the Asia Pacific region. Our 
clients include some of the largest globally recognised companies in 
areas such as finance, telecommunications, broadcasting, legal and 
government. Our aim is to provide the very best independent advice and 
a high level of technical expertise while creating long and lasting 
professional relationships with our clients. is committed to security research and 
development, and its team continues to identify and responsibly publish 
vulnerabilities in public and private software vendor's products. 
Members of the R&D team are globally recognised 
through their release of whitepapers and presentations related to new 
security research. is an Endorsed Commonwealth Government of 
Australia supplier and sits on the Australian Government 
Attorney-General's Department Critical Infrastructure Project panel. 
We are certified by both Visa and MasterCard under their Payment 
Card Industry Data Security Standard Programs.

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists