Ao you browser design defects control user browsers

Ao you browser design defects control user browsers

A browser design defect caused the browser to be controlled.

The latest version of Ao you Browser:
 

The main reason is that the cloud tag has a problem and the title is not filtered. Because the tag is in the maxthon.cn domain, the maxthon object can be used for browser control, this includes modifying the user name and password for table filling, modifying the browser proxy, and setting the home page.

Vulnerabilities:

The cloud push function does not effectively filter the title and access http: // 127.0.0.1/1.html. The Code is as follows:
 

In the test, the browser homepage is set as an example to load external js and bypass the length limit.

1. js:
 

url = "http://www.qq.com";maxthon.browser.config.ConfigManager.set("maxthon.config","browser.general.startpage",url);alert('start page is www.qq.com now!')

The code above serves to set the browser homepage code to www.qq.com.

When using the cloud push function, the title is not filtered:
 

It is not a privileged domain, so you cannot execute commands for the moment. However, you can control the browser because it is in the maxthon.cn domain.

After loading external js, you can see the Home Page modification:
 

Solution:

Fixes the XSS in the cloud push function.

Continue to control permissions under maxthon.cn.