-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Nth Dimension Security Advisory (NDSA20110321) Date: 21st March 2011 Author: Tim Brown URL: / Product: Konqueror 4.4.x, 4.5.x, 4.6.x Vendor: KDE Risk: Medium Summary The Konqueror web browser is vulnerable to HTML injection into the error pages that are displayed when it fails to fetch the requested URL. This could allow an arbitrary web site to be spoofed. After discussions with the vendor, CVE-2011-1168 was assigned to this vulnerability. Technical Details Konqueror 4.4.x, 4.5.x and 4.6.x are affected by HTML injection which allows an arbitrary URL to be spoofed. Opening a fresh instance of Konqueror and entering the following URL causes the error page HTML to become corrupted: http://thisdomainwillnotresolveandrekonqerrorpagewillbeshownwithfullurlembedded.twitter.com/">

Test

Since Konqueror fails to resolve the hostname it will then will display an error message containing the requested URL including the HTML tags. It is worth noting that Javascript execution does not appear to be possible in the context of the unresolvable hostname for two reasons. Firstly Konqueror disables Javascript within KHTMLPart::htmlError() (between the calls to begin() and end() and secondly because the code executes in an empty domain preventing the cookies for the spoofed URL from being accessed. Whilst the first of these restrictions could be bypassed in a number of ways (see below), no method has currently been identified to bypass the latter to break Konqueror's same origin policy. It was identified that the first restriction could be bypassed at least two ways. Firstly a link can be injected with a URL in the form javascript:... and secondly an iframe can be injected with a source URL in the form data:text/html,... In the first case, Konqueror only interprets the link at the point of clicking (after Javascript has been reenabled) whilst in the latter, Konqueror does not disable Javascript during the parsing of the source for this iframe (i.e. between the calls to begin() and end()). The following URL demonstrates how HTML can be injected which both takes control of the entire visible DOM by overriding the error page styles for an arbitrary "secure" URL and then allows Javascript to be executed in the victims browser: https://secure.twitter.com/