Wednesday, 5 December 2012

Avant Browser - Cross Context Scripting - browser:home - Most Visited And History Tabs


Details

Vendor Site: Avant browser (www.avantbrowser.com)
Date: December, 5 2012 – CVE (TBA)
Affected Software: Avant Browser Ultimate 2012 Build 27 and potentially previous versions
Status: Unpatched
Researcher: Roberto Suggi Liverani - @malerisch
PDF version: Avant_multiple_vulnerabilities_advisory.pdf


Cross Context Scripting – browser:home – Most Visited And History Tabs

A malicious user can inject arbitrary JavaScript/HTML code through the websites visited with the Avant Browser. The code injection is rendered into the both the Most Visited and History tabs within the browser:home page,  which displays URL and the title of the page. A malicious user can inject and store JavaScript/HTML content by using the <title> HTML element, as shown in the table below:

<title>aaa"><img src=a onerror='var vstr = {value: ""};window.navigator.AFRunCommand(60003, vstr);alert(vstr.value);'></title>

Injected payload is rendered in the history item, as shown below:


Exploitation

This vulnerability can be exploited in several ways depending on the user action. The table below describes two possible scenarios:

Scenario 1

User visits a malicious web page;
User directly requests browser:home and clicks on “Most Visited” or “History” tab.

Exploit

Stored malicious payload will be rendered from the browser: privileged browser zone and so it would be possible to bypass Same Origin Policy (SOP) protections, and access Avant Browser native JavaScript privileged functions which can be invoked from the window.navigator object (e.g. window.navigator.*). Such Avant Browser object interfaces can be used to read browser history, bookmarks, or modify Avant Browser configuration.

Scenario 2

Clickjacking attack which tricks a user into clicking the “most visited” or “history” tab of the browser:home page rendered in a hidden iframe.

Exploit

In this case, this can be considered a traditional stored Cross Site Scripting vulnerability and SOP is forbids execution of privileged commands.

Video

Avant Browser - Cross Context Scripting - browser:home - Most Visited And History Tabs


Timeline


07/03/2012 - Posted 10 posts to a forum to get a security contact
14/03/2012 - Reception of report confirmed but no further reply
14/03/2012 - Chased them, no reply
03-05/2012 - 2 new releases following the report, one bug silently fixed
12/05/2012 - HITB2012AMS - bug disclosed during presentation
14/11/2012 - HackPra - bug and exploit module presented


Solution

Do not use Avant browser.