2345 potential risks of poor security due to browser design defects

2345 potential risks of poor security due to browser design defects

It is not harmful, and can cause command execution under specific conditions.

Detailed description:

2345 the browser does not have a security prompt for running some files locally, such as the WScript. Shell object.



The sample code is as follows:

The token is saved as exe.htm. When opened with ie, a security prompt is displayed:
 

This is also true for the QQ browser with the ie kernel.
 

 

Proof of vulnerability:

Then we can use the 2345 browser to open it:
 

.. There is no security prompt, While ie, qq, and Other ie kernel browsers will prompt twice.

Solution:

Add a reminder mechanism, for example: