Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: New flaw found in Firefox 2.0.0.4: Firefox file input focus vulnerabilities
From: Joseph Hick <leet16y () yahoo com>
Date: Sat, 30 Jun 2007 13:54:46 -0700 (PDT)

This doesn't seem like a security flaw to me.

<input type="file" id="file1" name="file1"
onkeydown="restore();" onkeyup="restore()" />
<label for="file1" id="label1" name="label1"></label>
<br>
<textarea name="text1" id="text1"
onkeydown="doKeyDown()">

function doKeyDown()
{
        document.getElementById("label1").focus();
}

onkeydown, you are focusing on label1 which is tied to
file1. so onkeydown, file1 gets focus. so the keyup
event happens on file1 which triggers restore().
restore() copies text1 into file1.

function restore()
{
        
document.getElementById("text1").value=document.getElementById("file1").value;
        document.getElementById("text1").focus();
}

so why is this a security flaw? could you please
explain?

--- carl hardwick <hardwick.carl () gmail com> wrote:

PoC here:
http://yathong.googlepages.com/FirefoxFocusBug.html

The vulnerability allows the attacker to silently
redirect focus of
selected key press events to an otherwise protected
file upload form
field. This is possible because of how onKeyDown
event is handled,
allowing the focus to be moved between the two. This
enables the
attacker to read arbitrary files on victim's system.





 
____________________________________________________________________________________
The fish are biting. 
Get more visitors on your site using Yahoo! Search Marketing.
http://searchmarketing.yahoo.com/arp/sponsoredsearch_v2.php

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault