Multiple Vendor Multiple Product URI Handler Input Validation Vulnerability iDefense Security Advisory 07.19.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 19, 2007 I. BACKGROUND Microsoft Internet Explorer and Mozilla Firefox are the two most popular web browsers. Many people have both products installed since it is very difficult to remove Internet Explorer from a Windows system. Additionally, people are unlikely to remove Internet Explorer due to the need to use it for some sites which will not work with other browsers. II. DESCRIPTION Remote exploitation of an input handling vulnerability within multiple browsers on the Microsoft Windows platform allows code execution as the local user. This vulnerability is due to interaction between programs. The most commonly used Microsoft Windows URL protocol handling code doesn't provide a way for the URI handling application to distinguish the end of one argument from the start of another. The problem is caused by the fact that browsers do not pct-encode certain characters in some URIs, which does not comply with the behavior that RFC3986 (also known as IETF STD 66) requires. As a result, a specially constructed link could be interpreted as multiple arguments by a URI protocol handler. III. ANALYSIS Exploitation of this vulnerability allows an attacker to execute arbitrary commands as the current user. To exploit this vulnerability, an attacker must persuade their target into visiting a website containing a maliciously constructed link. This vulnerability does not allow for code execution directly. Instead it relies on the URI handling application to contain methods by which code execution is obtainable. Even if no such methods exist, it may still be possible to pass additional command line parameters that execute unintended actions. The target user must have an application installed which accepts command line options after the URI passed to the protocol handler, such as versions of Firefox before 2.0.0.5. When opening a URL, typically it is started with a command line such as: [path/to/handler.exe] -url "%1" In this case, the "%1" is replaced with the source URL. If the URL contains a double-quote character followed by a space, the quoting will be closed, and the rest of the source URL will be treated as new arguments. On June 14, 2007 Microsoft stated to us that this behavior is documented, referencing ( http://msdn2.microsoft.com/en-us/library/aa767914.aspx). At this time, the document contained an example handler for the 'note:' protocol to explain how to create URL handlers. It contained this type of vulnerability. The documentation did state that the "handler passes the complete URL string to the application", but did not explicitly state that multiple arguments could be injected, and that the URI would be percent-decoded. If the example handler from the documentation was added, calc.exe would be launched when opening a page that contained the following HTML: