Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: New flaw found in Firefox Firefox file input focus vulnerabilities
From: Joseph Hick <leet16y () yahoo com>
Date: Sat, 30 Jun 2007 13:54:46 -0700 (PDT)

This doesn't seem like a security flaw to me.

<input type="file" id="file1" name="file1"
onkeydown="restore();" onkeyup="restore()" />
<label for="file1" id="label1" name="label1"></label>
<textarea name="text1" id="text1"

function doKeyDown()

onkeydown, you are focusing on label1 which is tied to
file1. so onkeydown, file1 gets focus. so the keyup
event happens on file1 which triggers restore().
restore() copies text1 into file1.

function restore()

so why is this a security flaw? could you please

--- carl hardwick <hardwick.carl () gmail com> wrote:

PoC here:

The vulnerability allows the attacker to silently
redirect focus of
selected key press events to an otherwise protected
file upload form
field. This is possible because of how onKeyDown
event is handled,
allowing the focus to be moved between the two. This
enables the
attacker to read arbitrary files on victim's system.

The fish are biting. 
Get more visitors on your site using Yahoo! Search Marketing.

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]