Details
Vendor Site: Avant browser (www.avantbrowser.com)
Date: December, 5 2012 – CVE (TBA)
Status: Unpatched
Researcher: Roberto Suggi Liverani - @malerisch
PDF version: Avant_multiple_vulnerabilities_advisory.pdf
Cross Context Scripting – browser:home – Most Visited And History Tabs
A malicious user can inject arbitrary JavaScript/HTML code through the websites visited with the Avant Browser. The code injection is rendered into the both the Most Visited and History tabs within the browser:home page, which displays URL and the title of the page. A malicious user can inject and store JavaScript/HTML content by using the <title> HTML element, as shown in the table below:
<title>aaa"><img src=a onerror='var vstr = {value: ""};window.navigator.AFRunCommand(60003, vstr);alert(vstr.value);'></title>
Injected payload is rendered in the history item, as shown below:
This vulnerability can be exploited in several ways depending on the user action. The table below describes two possible scenarios:
Scenario 1
User visits a malicious web page;
User directly requests browser:home and clicks on “Most Visited” or “History” tab.
Exploit
Stored malicious payload will be rendered from the browser: privileged browser zone and so it would be possible to bypass Same Origin Policy (SOP) protections, and access Avant Browser native JavaScript privileged functions which can be invoked from the window.navigator object (e.g. window.navigator.*). Such Avant Browser object interfaces can be used to read browser history, bookmarks, or modify Avant Browser configuration.
Scenario 2
Clickjacking attack which tricks a user into clicking the “most visited” or “history” tab of the browser:home page rendered in a hidden iframe.
Exploit
In this case, this can be considered a traditional stored Cross Site Scripting vulnerability and SOP is forbids execution of privileged commands.
Video
Avant Browser - Cross Context Scripting - browser:home - Most Visited And History Tabs
Timeline
07/03/2012 - Posted 10 posts to a forum to get a security contact
14/03/2012 - Reception of report confirmed but no further reply
14/03/2012 - Chased them, no reply
03-05/2012 - 2 new releases following the report, one bug silently fixed
12/05/2012 - HITB2012AMS - bug disclosed during presentation
14/11/2012 - HackPra - bug and exploit module presented
Solution
Do not use Avant browser.