Wednesday, 5 December 2012

Maxthon - Privileged API Available On


Vendor Site: Maxthon (
Date: December, 6 2012 – CVE (TBA)
Affected Software: Maxthon and previous versions
Status: Patched
Researcher: Roberto Suggi Liverani - @malerisch

Privileged APIs Available on

The web site can access and use privileged Maxthon DOM object (e.g. maxthon.*). Such Maxthon object interfaces can be used to read last visited pages or favorites, as shown in the following screen shot. Such information can only be retrieved by using privileged Maxthon functions.

Different issues were identified regarding this design:
  1. No control on resolution of IP address for domain;
  2. No use of SSL to serve the web site;
  3. Use of icon "Trusted site" on the URL bar even when resolves to a different IP address.


This vulnerability can be exploited in several ways, as listed below:
  • DNS poisoning - Force resolution of to a controlled IP address
  • HTTP MiTM attack - malicious proxy which alters page content
  • Exploit XSS vulnerability in real site
Once it is possible to successfully perform one of the above attacks, then it would be possible to access Maxthon native JavaScript privileged functions which can be invoked from the Maxthon DOM object (e.g. maxthon.*). Such Maxthon object interfaces can be used to read and write from the file system, as well as execute arbitrary commands, steal stored passwords, or modify Maxthon configuration.


Maxthon - (DNS compromise scenario)


12/05/2012 - HITB2012AMS - bug disclosed during presentation
02/11/2012 - 25 new releases following the report – 2 bugs silently fixed
14/11/2012 - HackPra - bug and exploit module presented


Do not use Maxthon browser.