full-disclosure - Re: New flaw found in Firefox 2.0.0.4: Firefox file input focus vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <919856.21419.qm@web38012.mail.mud.yahoo.com>
Date: Sat, 30 Jun 2007 13:54:46 -0700 (PDT)
From: Joseph Hick <leet16y@...oo.com>
To: carl hardwick <hardwick.carl@...il.com>, Full-Disclosure@...ts.grok.org.uk
Subject: Re: New flaw found in Firefox 2.0.0.4: Firefox
	file input focus vulnerabilities

This doesn't seem like a security flaw to me.

<input type="file" id="file1" name="file1"
onkeydown="restore();" onkeyup="restore()" />
<label for="file1" id="label1" name="label1"></label>
<br>
<textarea name="text1" id="text1"
onkeydown="doKeyDown()">

function doKeyDown()
{
	document.getElementById("label1").focus();
}

onkeydown, you are focusing on label1 which is tied to
file1. so onkeydown, file1 gets focus. so the keyup
event happens on file1 which triggers restore().
restore() copies text1 into file1.

function restore()
{

document.getElementById("text1").value=document.getElementById("file1").value;
	document.getElementById("text1").focus();
}

so why is this a security flaw? could you please
explain?

--- carl hardwick <hardwick.carl@...il.com> wrote:

> PoC here:
> http://yathong.googlepages.com/FirefoxFocusBug.html
> 
> The vulnerability allows the attacker to silently
> redirect focus of
> selected key press events to an otherwise protected
> file upload form
> field. This is possible because of how onKeyDown
> event is handled,
> allowing the focus to be moved between the two. This
> enables the
> attacker to read arbitrary files on victim's system.
> 

____________________________________________________________________________________
The fish are biting. 
Get more visitors on your site using Yahoo! Search Marketing.
http://searchmarketing.yahoo.com/arp/sponsoredsearch_v2.php

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/