malerisch.net

Details Vendor Site: Avant browser ( www.avantbrowser.com ) Date: December, 5 2012 – CVE (TBA) Affected Software: Avant Browser Ultimate 2012 Build 28 and potentially previous versions Status: Unpatched Researcher: Roberto Suggi Liverani -  @malerisch PDF version:  Avant_multiple_vulnerabilities_advisory.pdf Stored Cross Site Scripting - Feed Reader (browser://localhost/lst?*) A malicious user can inject and store arbitrary JavaScript/HTML code via multiple RSS feed elements. Vulnerable elements are the following: <title>  element: JavaScript injection using HTML encoded payload <link>  element: JavaScript injection using javascript: pseudouri ( this is rendered in about:blank zone.) <description>  element: JavaScript injection using HTML encoded payload The following table shows an example of malicious RSS feed: <?xml version='1.0' encoding="ISO-8859-1"?> <rss version='2.0'> <channel> <...

Details Vendor Site: Avant browser ( www.avantbrowser.com ) Date: December, 5 2012 – CVE (TBA) Affected Software: Avant Browser Ultimate 2012 Build 27 and potentially previous versions Status: Unpatched Researcher: Roberto Suggi Liverani -  @malerisch PDF version:  Avant_multiple_vulnerabilities_advisory.pdf Cross Context Scripting – browser:home – Most Visited And History Tabs A malicious user can inject arbitrary JavaScript/HTML code through the websites visited with the Avant Browser. The code injection is rendered into the both the Most Visited and History tabs within the browser:home page,  which displays URL and the title of the page. A malicious user can inject and store JavaScript/HTML content by using the <title> HTML element, as shown in the table below: <title>aaa"><img src=a onerror='var vstr = {value: ""};window.navigator.AFRunCommand(60003, vstr);alert(vstr.value);'></title> Injected payload is render...

Details Vendor Site: Avant browser ( www.avantbrowser.com ) Date: December, 5 2012 – CVE (TBA) Affected Software: Avant Browser Ultimate 2012 Build 28 and potentially previous versions Status: Unpatched Researcher: Roberto Suggi Liverani -  @malerisch PDF version: Avant_multiple_vulnerabilities_advisory.pdf Same of Origin Policy Bypass A malicious user can execute arbitrary JavaScript/HTML code on the privileged browser:home page from an untrusted web page on Internet (http:// zone). This is possible by creating an iframe element pointing to the browser:home page and then invoking privileged commands using a window object reference to the iframe element, as shown in the example below: <iframe name="test2" src=" browser:home "></iframe> <script> window['test2'].navigator.AFRunCommand(id_of_privileged_command, vstr) </script> This code allows interaction from an untrusted zone (http://) to a trusted and priv...

Details Vendor Site: Maxthon (www.maxthon.com) Date: December, 5 2012 – CVE (TBA) Affected Software: Maxthon 3.4.5.2000 and previous versions Status: Patched Researcher: Roberto Suggi Liverani -  @malerisch PDF version:  Maxthon_multiple_vulnerabilities_advisory.pdf Incorrect Executable File Handling The way local executable files are handled by the Maxthon browser seems related to the fact that external tools such as Calc, Desktop, and others can be launched from the browser itself. This design is insecure as it allows JavaScript to directly invoke an executable. As shown in previous exploits, this design can aid exploitation by chaining different vulnerabilities at the same time, allowing for arbitrary command execution. This vulnerability can be exploited in multiple ways: Scenario 1 1. User visits a page which invokes the window.open() function against an executable file – e.g. file:///C:/windows/system32/cmd.exe 2. User unblocks the pop up bl...

Details Vendor Site: Maxthon (www.maxthon.com) Date: December, 5 2012 – CVE (TBA) Affected Software: Maxthon 3.3.3.1000 and previous versions Status: Patched Researcher: Roberto Suggi Liverani -  @malerisch PDF version:  Maxthon_multiple_vulnerabilities_advisory.pdf Cross Context Scripting Cross Context Scripting   (XCS) is a particular code injection attack vector where the injection occurs from an untrusted zone (e.g. Internet) into a privileged browser zone. In this case, it is possible to inject arbitrary JavaScript/HTML code from an untrusted page into Maxthon browser privileged zone - mx://res/*. Description It is possible to inject JavaScript/HTML payload via the “title” parameter of the “Add to Favorites” form. In Maxthon, bookmark UI security controls are weak and allow a trivial exploitation, even for an attentive user, considering the following factors: window.external.addFavorite() can be invoked in an automated fashion; The tit...

Details Vendor Site: Maxthon (www.maxthon.com) Date: December, 6 2012 – CVE (TBA) Affected Software: Maxthon 3.4.5.2000 and previous versions Status: Patched Researcher: Roberto Suggi Liverani -  @malerisch Privileged APIs Available on i.maxthon.com The web site i.maxthon.com can access and use privileged Maxthon DOM object (e.g. maxthon.*). Such Maxthon object interfaces can be used to read last visited pages or favorites, as shown in the following screen shot. Such information can only be retrieved by using privileged Maxthon functions. Different issues were identified regarding this design: No control on resolution of IP address for i.maxthon.com domain; No use of SSL to serve the i.maxthon.com web site; Use of icon "Trusted site" on the URL bar even when i.maxthon.com resolves to a different IP address. Exploitation This vulnerability can be exploited in several ways, as listed below: DNS poisoning - Force resolution of i.maxthon.com...

Details Vendor Site: Maxthon (www.maxthon.com) Date: December, 5 2012 – CVE (TBA) Affected Software: Maxthon 3.4.5.2000 and previous versions Status: Unpatched (at the time of publishing) Researcher: Roberto Suggi Liverani -  @malerisch PDF version: Maxthon_multiple_vulnerabilities_advisory.pdf Cross Context Scripting Cross Context Scripting   (XCS) is a particular code injection attack vector where the injection occurs from an untrusted zone (e.g. Internet) into a privileged browser zone. In this case, it is possible to inject arbitrary JavaScript/HTML code from an untrusted page into Maxthon browser privileged zone - mx://res/*. Description A malicious user can inject arbitrary JavaScript/HTML code via multiple RSS feed elements. Vulnerable elements are the following: <title> element: JavaScript injection using HTML encoded payload <link> element: JavaScript injection using javascript: pseudouri <description> element:...

Details Vendor Site: Maxthon (www.maxthon.com) Date: December, 5 2012 – CVE (TBA) Affected Software: Maxthon 3.4.5.2000 and previous versions Status: Unpatched (at the time of publishing) Researcher: Roberto Suggi Liverani - @malerisch PDF version:  Maxthon_multiple_vulnerabilities_advisory.pdf Cross Context Scripting Cross Context Scripting  (XCS) is a particular code injection attack vector where the injection occurs from an untrusted zone (e.g. Internet) into a privileged browser zone. In this case, it is possible to inject arbitrary JavaScript/HTML code from an untrusted page into Maxthon browser privileged zone - mx://res/*. Description A malicious user can inject arbitrary JavaScript/HTML code through the websites visited with the Maxthon browser. The code injection is rendered into the History page (about:history), which displays URL and a short description of the visited pages. A malicious user can inject JavaScript/HTML content by using the l...