malerisch.net

Details Vendor Site: Avant browser ( www.avantbrowser.com ) Date: December, 5 2012 – CVE (TBA) Affected Software: Avant Browser Ultimate 2012 Build 28 and potentially previous versions Status: Unpatched Researcher: Roberto Suggi Liverani -  @malerisch PDF version: Avant_multiple_vulnerabilities_advisory.pdf Same of Origin Policy Bypass A malicious user can execute arbitrary JavaScript/HTML code on the privileged browser:home page from an untrusted web page on Internet (http:// zone). This is possible by creating an iframe element pointing to the browser:home page and then invoking privileged commands using a window object reference to the iframe element, as shown in the example below: <iframe name="test2" src=" browser:home "></iframe> <script> window['test2'].navigator.AFRunCommand(id_of_privileged_command, vstr) </script> This code allows interaction from an untrusted zone (http://) to a trusted and priv

Details Vendor Site: Maxthon (www.maxthon.com) Date: December, 5 2012 – CVE (TBA) Affected Software: Maxthon 3.4.5.2000 and previous versions Status: Patched Researcher: Roberto Suggi Liverani -  @malerisch PDF version:  Maxthon_multiple_vulnerabilities_advisory.pdf Incorrect Executable File Handling The way local executable files are handled by the Maxthon browser seems related to the fact that external tools such as Calc, Desktop, and others can be launched from the browser itself. This design is insecure as it allows JavaScript to directly invoke an executable. As shown in previous exploits, this design can aid exploitation by chaining different vulnerabilities at the same time, allowing for arbitrary command execution. This vulnerability can be exploited in multiple ways: Scenario 1 1. User visits a page which invokes the window.open() function against an executable file – e.g. file:///C:/windows/system32/cmd.exe 2. User unblocks the pop up blocker Scenar