Darksat IT Security Forums
October 18, 2019, 10:56:29 pm
Welcome, Guest. Please login or register.

Login with username, password and session length
News: Darksat IT Security Forum
From Firewall Support, AntiVirus Questions, Spyware problems, Linux and Windows Security, Black Hat SEO right down to Website Design and Multimedia
 
  Home Help Search Gallery Links Staff List Login Register  

Firefox focus stealing security hole**


Pages: [1]
  Print  
Author Topic: Firefox focus stealing security hole**  (Read 826 times)
Darksat
Administrator
Master
*******
Posts: 3303



View Profile WWW
« on: February 13, 2007, 05:08:11 am »

This is a variant on a very old one.
I remember putting something like this together for IE5 a few years ago.


**Quote**

There is an interesting logic flaw in Mozilla Firefox web browser.

The vulnerability allows the attacker to silently redirect focus of
selected key press events to an otherwise protected file upload form
field. This is possible because of how onKeyDown / onKeyPress events are
handled, allowing the focus to be moved between the two. If exploited,
this enables the attacker to read arbitrary files on victim's system.

This was tested with 2.0.0.1. Opera is most likely not vulnerable;
Microsoft Internet Explorer is not vulnerable as-is, but might be
vulnerable to a variant of the attack.

All INPUT TYPE=FILE form fields enjoy the benefits of added protection to
prvent scripts from arbitrarily choosing local files to be uploaded to the
server, and automatically submitting the form. For example, .value
parameter cannot be set or changed, and any changes to .type reset the
contents of the field.

Unfortunately, Firefox allows a malicious script to redirect carefully
selected, individual user keystrokes to a hidden file upload field, in
order to compose a particular filename, then submit the form. User
interaction is required, limiting the impact somewhat - but any website
where the user can be reasonably expected to enter some text (a
keyboard-controlled web game, a blog posting or commenting interface) can
attempt to exploit the vulnerability, and eventually succeed with one user
or another.

A quick and naive demonstration of the problem (Firefox on Windows is
required; depends on scancode values, so not all keyboards may be
supported):

http://lcamtuf.coredump.cx/focusbug/

(Ta-dah again)

/mz

**End Quote**
Report Spam   Logged

N o o R
new
*
Posts: 1


View Profile
« Reply #1 on: February 14, 2007, 09:51:45 am »

hmmmmmmmmmm
Report Spam   Logged
Darksat
Administrator
Master
*******
Posts: 3303



View Profile WWW
« Reply #2 on: February 14, 2007, 10:21:22 am »

Wow, Elequant.  Grin

Welcome Noor, Feel Free to post sentences if you want. Wink
Report Spam   Logged

Pages: [1]
  Print  
 
Jump to:  

Powered by EzPortal
eXTReMe Tracker
Security Forum
Bookmark this site! | Upgrade This Forum
SMF For Free - Create your own Forum


Powered by SMF | SMF © 2016, Simple Machines
Privacy Policy
Page created in 0.031 seconds with 13 queries.