Bugtraq: RE: Internet Explorer and Opera local zone restriction bypass

["Thor Larholm" <thor () pivx com>]

> From: Andreas Sandblad [mailto:sandblad () acc umu se]
> I can only reproduce it together with user-interaction, that is manually
> pressing refresh in Internet Explorer. I did some attempts to try to
> automaticly refresh the page using javascript but without any luck
> (denied access due to cross-site-policy).
There is absolutely no requirement for any user-interaction, as you can
programmatically click the Refresh button - or rather, trigger the exact same
non-window-object-dependant non-cross-site functionality in the current window
object where you have all the access you need.

document.execCommand("Refresh");

http://msdn.microsoft.com/workshop/author/dhtml/reference/methods/execcommand.asp

Refresh is just one of the many command identifiers that document and range
objects can utilize

http://msdn.microsoft.com/workshop/author/dhtml/reference/commandids.asp

Use a third window object to store the state on wether or not you have refreshed
already, to avoid an infinite loop.



Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher
http://pivx.com/larholm/ - Get our research, join our mailinglist