Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » Retrieving information on local files in IE

Retrieving information on local files in IE

by Nikola Strahija on March 27th, 2002 The problem lies within the dynsrc property's implementation, which completely ignores the source validity and gives script access to the assigned file even if it is not presentable.


Affected applications:
======================

All tested versions of Microsoft Internet Explorer (IE5+); prior versions
may be vulnerable as well.


Introduction:
=============

The element is commonly used to present images on an HTML document.
However, it also contains a feature that allows it to present other types of
media, such as VRML, AVI, MPEG, etc.

This feature was implemented in the form of a property named dynsrc.


Discussion:
===========

The problem lies within the dynsrc property's implementation, which
completely ignores the source validity and gives script access to the
assigned file even if it is not presentable.

Once a file name has been assigned to the dynsrc property it is possible to
see whether it exists by checking the fileSize property of the
element, if the return value is -1 then it is certain that the file does not
exist, any greater value indicates that the file exists.

When a file has been known to exist it is possible to extract additional
information from the element.

Such as:

* The file size in bytes, using the fileSize property.
* The date the file was created, using the fileCreatedDate property.
* The date the file was last modified, using the fileModifiedDate property.
* The date the file was last updated, using the fileUpdatedDate property.

A malicious attacker may use this bug in conjunction with other bugs to
detect files or determine whether the user has specific programs (and even
specific versions, according to size) installed, etc.


Exploit:
========

This simple example demonstrates how the bug is used to check whether
"c:/test.txt" exists and retrieves its additional properties if it does.



setTimeout(
function () {
alert(
oFile.fileSize>-1 ?
"File exists!nn"+
"Size: "+oFile.fileSize+" bytes.n"+
"Created: "+oFile.fileCreatedDate+".n"+
"Modified: "+oFile.fileModifiedDate+".n"+
"Updated: "+oFile.fileUpdatedDate+"."
:
"File does not exist."
);
},
250
);



Solution:
=========

Microsoft was first informed on 18 Feb 2002 (38 days ago), they have opened
an investigation regarding this issue and will probably release a patch in
the near future.

Until a patch becomes available the only workaround is to disable Active
Scripting.


Tested on:
==========

IE5sp2 NT4 sp6a, all possible patches.
IE5.5sp2 Win98, all patches.
IE5.5sp2 NT4 sp6a, all patches.
IE6sp1 Win2000 sp2, all patches.


Demonstration:
==============

A fully dynamic proof-of-concept demonstration of this issue is available at
http://security.greymagic.com/adv/gm003-ie/.


Feedback:
=========

Please mail any questions or comments to [email protected]

- Copyright © 2002 GreyMagic Software.



Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »