exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

msieDHTML.txt

msieDHTML.txt
Posted Dec 30, 2004
Authored by Paul From Greyhats

The MSIE DHTML Edit Control code is susceptible to a cross site scripting vulnerability.

tags | advisory, xss
SHA-256 | a2fa0ec2b881347447d64fdd1223cffc003f89298b518e83dc245a833c9ccd93

msieDHTML.txt

Change Mirror Download


Note: This vulnerability as well as many more can be seen at http://freehost07.websamba.com/greyhats/

MSIE DHTML Edit Control Cross Site Scripting Vulnerability

[Tested]
IEXPLORE.EXE file version 6.0.2900.2180
MSHTML.DLL file version 6.00.2800.1400
Microsoft Windows XP Home SP2


[Discussion]
I appologize for my previous vulnerability (longnamevuln) which, through default sp2 settings, would be quite useless :). However, I'm sure that this will make up for it.

While looking at the popup block killer by http-equiv, I became interested in the dhtml edit control. I had a gut fealing that more could be done than simple popup forcing. So I looked into it and surely enough, I did find something. For the first time (afaik) since sp1, we can, without user interaction (which I hate btw), inject script into a page that doesnt belong to us :).

While I don't exacly know the specifics of the dhtmled.ocx control, I believe it uses a lot of the same code from old versions of internet explorer. That might explain why it acts so similarly to internet explorer. Through my testing, I only found one way to navigate to a page using the dhtml edit control: make it run code to 1) specify its window name, then 2) open( ) a page using its new name as the target parameter. This will grab the page and display it in the control. After this, the control is still accessible by its parent, even Script functions. execScript is what I use to directly inject javascript into the control.

SP2 puts extremely heavy security on the javascript: and vbscript: protocols, apparently rendering them useless for hacking attempts. However, there are still plenty of ways to make a target run script. Hehe this is just like to good ol' days of sp1 :)

The example opens http://google.com in the dhtml edit control and attempts to show the location.href and document.cookie of the page in a message box.

Example at http://freehost07.websamba.com/greyhats/abusiveparent.htm
Login or Register to add favorites

File Archive:

September 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    261 Files
  • 2
    Sep 2nd
    17 Files
  • 3
    Sep 3rd
    38 Files
  • 4
    Sep 4th
    52 Files
  • 5
    Sep 5th
    23 Files
  • 6
    Sep 6th
    27 Files
  • 7
    Sep 7th
    0 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    16 Files
  • 10
    Sep 10th
    38 Files
  • 11
    Sep 11th
    21 Files
  • 12
    Sep 12th
    40 Files
  • 13
    Sep 13th
    18 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    0 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close