Wednesday, 5 December 2012

Maxthon - Privileged API Available On i.maxthon.com



Details

Vendor Site: Maxthon (www.maxthon.com)
Date: December, 6 2012 – CVE (TBA)
Affected Software: Maxthon 3.4.5.2000 and previous versions
Status: Patched
Researcher: Roberto Suggi Liverani - @malerisch



Privileged APIs Available on i.maxthon.com

The web site i.maxthon.com can access and use privileged Maxthon DOM object (e.g. maxthon.*). Such Maxthon object interfaces can be used to read last visited pages or favorites, as shown in the following screen shot. Such information can only be retrieved by using privileged Maxthon functions.


Different issues were identified regarding this design:
  1. No control on resolution of IP address for i.maxthon.com domain;
  2. No use of SSL to serve the i.maxthon.com web site;
  3. Use of icon "Trusted site" on the URL bar even when i.maxthon.com resolves to a different IP address.

Exploitation

This vulnerability can be exploited in several ways, as listed below:
  • DNS poisoning - Force resolution of i.maxthon.com to a controlled IP address
  • HTTP MiTM attack - malicious proxy which alters page content
  • Exploit XSS vulnerability in real i.maxthon.com site
Once it is possible to successfully perform one of the above attacks, then it would be possible to access Maxthon native JavaScript privileged functions which can be invoked from the Maxthon DOM object (e.g. maxthon.*). Such Maxthon object interfaces can be used to read and write from the file system, as well as execute arbitrary commands, steal stored passwords, or modify Maxthon configuration.

Video

Maxthon - i.maxthon.com (DNS compromise scenario)


Timeline

12/05/2012 - HITB2012AMS - bug disclosed during presentation
02/11/2012 - 25 new releases following the report – 2 bugs silently fixed
14/11/2012 - HackPra - bug and exploit module presented

Solution

Do not use Maxthon browser.