mailing list archives
Re: New flaw found in Firefox 220.127.116.11: Firefox file input focus vulnerabilities
From: ascii <ascii () katamail com>
Date: Sun, 01 Jul 2007 03:17:41 +0200
carl hardwick wrote:
PoC here: http://yathong.googlepages.com/FirefoxFocusBug.html
The vulnerability allows the attacker to silently redirect focus of
selected key press events to an otherwise protected file upload form
field. This is possible because of how onKeyDown event is handled,
allowing the focus to be moved between the two. This enables the
attacker to read arbitrary files on victim's system.
many thanks for sharing this : )
it's a pretty serious vulnerability as said by Zalewski
Francesco `ascii` Ongaro
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/