Microsoft IE window.open Redirect Vulnerability
BID:766
Info
Microsoft IE window.open Redirect Vulnerability
| Bugtraq ID: | 766 |
| Class: | Race Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Nov 04 1999 12:00AM |
| Updated: | Nov 04 1999 12:00AM |
| Credit: | Discovered by Georgi Guninski and Shane Hird. Posted to Bugtraq on November 4, 1999 by Georgi Guninski <[email protected]>. |
| Vulnerable: |
Microsoft Outlook 98 0 Microsoft Internet Explorer 5.0 for Windows NT 4 Microsoft Internet Explorer 5.0 for Windows 98 Microsoft Internet Explorer 5.0 for Windows 95 Microsoft Internet Explorer 4.0 for Windows NT 4 Microsoft Internet Explorer 4.0 for Windows NT 3 Microsoft Internet Explorer 4.0 for Windows 95 Microsoft Internet Explorer 4.0 |
| Not Vulnerable: | |
Discussion
Microsoft IE window.open Redirect Vulnerability
If window.open is called with a target URL that redirects to a client-side file and then a variable is created pointing to the contents of the new window, the contents of the new window (the local file) can be read and possibly manipulated or transmitted by other code in the webpage.
The filename and location would have to be known by the attacker, and it could only be a file that is viewable by a browser.
If window.open is called with a target URL that redirects to a client-side file and then a variable is created pointing to the contents of the new window, the contents of the new window (the local file) can be read and possibly manipulated or transmitted by other code in the webpage.
The filename and location would have to be known by the attacker, and it could only be a file that is viewable by a browser.
Exploit / POC
Microsoft IE window.open Redirect Vulnerability
Demonstration available at:
http://www.nat.bg/~joro/msredir1.html
The exploit code is:
a=window.open(some URL that redirects to the local file);
b=a.document;
Then the contents of the local file can be read or otherwise manipulated by referring to b.
Demonstration available at:
http://www.nat.bg/~joro/msredir1.html
The exploit code is:
a=window.open(some URL that redirects to the local file);
b=a.document;
Then the contents of the local file can be read or otherwise manipulated by referring to b.
Solution / Fix
Microsoft IE window.open Redirect Vulnerability
Solution:
Microsoft has released a patch to address this issue, available at:
http://www.microsoft.com/windows/ie/security/servredir.asp
Solution:
Microsoft has released a patch to address this issue, available at:
http://www.microsoft.com/windows/ie/security/servredir.asp
References
Microsoft IE window.open Redirect Vulnerability
References:
References: