Media Preview Script Execution Vulnerability

Type securityvulns
Reporter Securityvulns
Modified 2004-07-13T00:00:00


Note: This vulnerability as well as several more can be found at

Media Preview Script Execution Vulnerability

[Tested] MSDXM.DLL file version Microsoft Windows 2000

[Discussion] By using the windows media player control, media can be played in a browser, including asx files, which is just a playlist of media. If one of these files on the list is a weird protocol like javascript:, it will be executed in the zone of the page that called it. At first, this seems to be a small problem. However, on windows 2000, media can be previewed on a panel to the left if the media file is in a local directory and the user clicks on it. The panel uses the windows media player control to preview the media. If a user clicks on a specially-crafted asx file, javascript will be executed in the local zone.

The example is a vulnerable asx file which, when clicked in explorer, will display a messagebox wiith the location of the directory.

Note: The asx file must be opened in the media player control. It will not work if opened in windows media player itself.