Darksat IT Security Forums
June 04, 2020, 09:06:35 am
Welcome, Guest. Please login or register.

Login with username, password and session length
News: Darksat IT Security Forum
From Firewall Support, AntiVirus Questions, Spyware problems, Linux and Windows Security, Black Hat SEO right down to Website Design and Multimedia
  Home Help Search Gallery Links Staff List Login Register  

Firefox focus stealing security hole**

Pages: [1]
Author Topic: Firefox focus stealing security hole**  (Read 831 times)
Posts: 3303

View Profile WWW
« on: February 13, 2007, 05:08:11 am »

This is a variant on a very old one.
I remember putting something like this together for IE5 a few years ago.


There is an interesting logic flaw in Mozilla Firefox web browser.

The vulnerability allows the attacker to silently redirect focus of
selected key press events to an otherwise protected file upload form
field. This is possible because of how onKeyDown / onKeyPress events are
handled, allowing the focus to be moved between the two. If exploited,
this enables the attacker to read arbitrary files on victim's system.

This was tested with Opera is most likely not vulnerable;
Microsoft Internet Explorer is not vulnerable as-is, but might be
vulnerable to a variant of the attack.

All INPUT TYPE=FILE form fields enjoy the benefits of added protection to
prvent scripts from arbitrarily choosing local files to be uploaded to the
server, and automatically submitting the form. For example, .value
parameter cannot be set or changed, and any changes to .type reset the
contents of the field.

Unfortunately, Firefox allows a malicious script to redirect carefully
selected, individual user keystrokes to a hidden file upload field, in
order to compose a particular filename, then submit the form. User
interaction is required, limiting the impact somewhat - but any website
where the user can be reasonably expected to enter some text (a
keyboard-controlled web game, a blog posting or commenting interface) can
attempt to exploit the vulnerability, and eventually succeed with one user
or another.

A quick and naive demonstration of the problem (Firefox on Windows is
required; depends on scancode values, so not all keyboards may be


(Ta-dah again)


**End Quote**
Report Spam   Logged

Share on Facebook Share on Twitter

N o o R
Posts: 1

View Profile
« Reply #1 on: February 14, 2007, 09:51:45 am »

Report Spam   Logged
Posts: 3303

View Profile WWW
« Reply #2 on: February 14, 2007, 10:21:22 am »

Wow, Elequant.  Grin

Welcome Noor, Feel Free to post sentences if you want. Wink
Report Spam   Logged

Pages: [1]
Jump to:  

Powered by EzPortal
eXTReMe Tracker
Security Forum
Bookmark this site! | Upgrade This Forum
SMF For Free - Create your own Forum

Powered by SMF | SMF © 2016, Simple Machines
Privacy Policy
Page created in 0.031 seconds with 14 queries.