exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Babylon Cross-Application Scripting Code Execution

Babylon Cross-Application Scripting Code Execution
Posted Nov 11, 2010
Authored by Yair Amit, Roee Hay

The Babylon online dictionary and translation software fails to sanitize user input before rendering it on the Trident control, effectively leading to a cross-application scripting vulnerability. The Trident control runs in Local Machine Zone (LMZ) which is not Locked down and due to this the vulnerability can allow for code execution.

tags | advisory, local, code execution
SHA-256 | 521bd04a9d93d3243cb54ea1da35796ea3e0170a38c45bee3986db191b659c09

Babylon Cross-Application Scripting Code Execution

Change Mirror Download

Babylon is a single-click computer online dictionary and translation
which is also capable of translating whole documents and web pages. The
translation and dictionary results are presented to the user via the
layout engine (an in-app/embedded Internet-Explorer rendering engine).

Babylon fails to sanitize user input before rendering it on the Trident
effectively leading to a Cross-Application Scripting vulnerability.

The user's input can originate from the following sources:

1. Babylon's main translation interface: When searching for a non-existent
term Babylon pushes the string "No matches were found for 'non-existent
term'. Search the web for non-existent-term". Unfortunately,
term' is not HTML encoded or validated before it is written on the
browser (the translation process transparently validates translatable

2. Document translation: Documents (such as PDF files) may contain text
cannot be translated (e,g. JavaScript code), in such case it is rendered
without HTML encoding or validation.

3. Web site translation: Same as the document translation case. Text which
not translated is simply rendered on the Trident control. In order to
an attack, the victim has to be lured into translating malicious text,
in a document or on a web page. Although the scenarios require some
social-engineering, some of them are feasible and realistic.

The Trident control runs in Local Machine Zone (LMZ) which is not Locked

This allows a malicious script to perform the following actions:

1. Interact with other websites in the background while using persistent
to impersonate the victim: This can be done using XHR. The payload can
the response's body which may contain sensitive information in case the
victim has been authenticated on the site prior to the attack. The
can also perform actions on the site on behalf of the victim.

2. Collect information from local files: This can be done using XHR or by a
hidden iframe with the filename's as the source. Since the payload runs
in a
non-Locked-down LMZ, the XHR response or iframe's body can be inspected
sent back to the attacker.

3. Code execution: System commands can be executed by using the
ActiveX object to practically take over the whole system.

Vulnerable versions
Versions prior to 8.0.7 are susceptible to this vulnerability.

Yair Amit <amityair@il.ibm.com>
Roee Hay <roeeh@il.ibm.com>

We would like to thank the Babylon team for their quick responses and the
efficient way in which they handled this security issue.

1. Original advisory:
2. Blog post:


3. Demo:
4. Babylon's homepage:
5. Enhanced Browsing Security:
Login or Register to add favorites

File Archive:

December 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    11 Files
  • 2
    Dec 2nd
    0 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    32 Files
  • 5
    Dec 5th
    10 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By