Vendor Site: Maxthon (www.maxthon.com)
Date: December, 6 2012 – CVE (TBA)
Affected Software: Maxthon 22.214.171.1240 and previous versions
Researcher: Roberto Suggi Liverani - @malerisch
Privileged APIs Available on i.maxthon.com
The web site i.maxthon.com can access and use privileged Maxthon DOM object (e.g. maxthon.*). Such Maxthon object interfaces can be used to read last visited pages or favorites, as shown in the following screen shot. Such information can only be retrieved by using privileged Maxthon functions.
Different issues were identified regarding this design:
- No control on resolution of IP address for i.maxthon.com domain;
- No use of SSL to serve the i.maxthon.com web site;
- Use of icon "Trusted site" on the URL bar even when i.maxthon.com resolves to a different IP address.
This vulnerability can be exploited in several ways, as listed below:
- DNS poisoning - Force resolution of i.maxthon.com to a controlled IP address
- HTTP MiTM attack - malicious proxy which alters page content
- Exploit XSS vulnerability in real i.maxthon.com site
Maxthon - i.maxthon.com (DNS compromise scenario)
12/05/2012 - HITB2012AMS - bug disclosed during presentation
02/11/2012 - 25 new releases following the report – 2 bugs silently fixed
14/11/2012 - HackPra - bug and exploit module presented
Do not use Maxthon browser.