Talk:MHTML
From Wikipedia, the free encyclopedia
Here is an interesting cross domain leackage hack, that is implemented using mhtml
IE6.0 and IE7.0 Vulnerable to Complete Cross Domain Leakage
This is some of the worst ownage I’ve seen in a long time. Secunia announced a really nasty cross domain leak for Internet Explorer. This allows anyone with control over a webserver to control anything you do with any page you can connect to. It’s interesting that Secunia marked it as a “less critical” threat, as this pretty much gives any attacker read access to any domain anywhere as long as you are using Internet Explorer 6.0 or 7.0.
The only saving grace here is that it does require access to a server where you can write HTTP headers (or somewhere that you can do header injection/redirection) as you need to force the browser to go to a certain URL which then redirects to another URL. Here’s what the header’s look like:
telnet secunia.com 80 Trying 213.150.41.226… Connected to secunia.com. Escape character is ‘^]’. GET /ie_redir_test_1/1234 HTTP/1.0
HTTP/1.1 302 Found Date: Thu, 19 Oct 2006 15:38:46 GMT Server: Apache Location: mhtml:http://secunia.com/ie_redir_test_2 Connection: close Content-Type: text/html
telnet secunia.com 80 Trying 213.150.41.226… Connected to secunia.com. Escape character is ‘^]’. GET /ie_redir_test_2 HTTP/1.0
HTTP/1.1 302 Found Date: Thu, 19 Oct 2006 15:39:00 GMT Server: Apache Location: http://news.google.com/ Connection: close Content-Type: text/html
At this point the client is redirected to the server as you (with your credentials) and it is returned as a cachable mhtml file that can be read via XMLHttpRequest since it “appears” to your browser to be located on the machine that did the redirection. Pretty clever. I’ve played around with these sorts of things before but was never successful (obviously I never tried mhtml). It seems to me that someone was saving this one.
And remember our nonces we were using to protect against CSRF? Well forget it, they’re readable by the cross domain leakage now. I don’t know why anyone would say this is a less critical risk as this is complete ownage of the entire internet for users of Internet Explorer. Hopefully Microsoft will patch this one quickly.
This entry was posted on Thursday, October 19th, 2006 at 8:49 am and is filed under XSS, Webappsec. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site. One Response to “IE6.0 and IE7.0 Vulnerable to Complete Cross Domain Leakage”
