[VulnWatch] [DR001] AppleWebKit XMLHttpRequest arbitrary file disclosure vulnerability
From: David Remahl (vuln_at_remahl.se)
To: firstname.lastname@example.org Date: Sun, 17 Apr 2005 14:59:43 +0200
-----BEGIN PGP SIGNED MESSAGE-----
The full, up-to-date, text of this advisory is located at:
Title: AppleWebKit XMLHttpRequest arbitrary file disclosure
Date of discovery: 2005-02-13
Date of publication: 2005-04-16
Discovered by: David Remahl (email@example.com)
Impact: arbitrary file disclosure, origin validation error
Apple Safari 1.2+
Apple Safari RSS 2.0, pre-release
OmniGroup OmniWeb 5.1+
Shiira 0.93 does not support automatic disk image mounting but is
vulnerable to other ways of predicting file paths.
Other applications that use recent versions of WebCore/WebKit and
Possibly / partially vulnerable
Other applications that utilize KHTML
Verified not vulnerable
Mozilla Firefox 1.0
Konqueror 3.3 [prevents the redirection to the local file but
allows local files the same access to XMLHttpRequest as Safari and
Don't support XMLHttpRequest:
Apple Safari <1.2
OmniGroup OmniWeb 5.0.x
Freeverse BumperCar 1.0
http queries and read their result.
The attack described herein requires that the attacker has the ability
to place an HTML file on the victim's system and predict its path. By
exploiting AppleWebKit's special treatment of XMLHttpRequest when
running from a file: document, the attacker can gain read access to
any file on the system with a known path that the user running the
browser has access to.
The automatic mounting of disk images performed by default by Safari
and OmniWeb provides the attacker with an easy way to get the local
file onto the user's system. Other approaches exist, such as
predicting the path to the user's download directory, using an afp://
or ftp:// URL to mount a remote unit and access it using
This vulnerability allows a remote attacker to read files with known
path names on a user's system. The vulnerability also allows the
attacker to bypass the restriction that XMLHttpRequests may only be
made to the server hosting the original document.
There is a potential for other types of disclosure due to the
attacker's opportunity to run any code from a local file.
The impact of this vulnerability is diminished but not eliminated if
the automatic mounting of disk images and remote volumes is disabled.
A benign demonstration of the vulnerability is provided at the
The demonstration downloads and mounts a disk image when a link is
clicked. It then redirects an iframe to the predicted path of the
exploit document. The document is also available over http for
completeness. A real attacker would be able to make the attack a lot
Alternative possibilities of getting a file with a know path onto the
victim's system are discussed on the in-depth discussion page.
2005-02-13, 19:34 UTC: Working on a fix.
According to CERT (2005-03-17), OmniGroup plans to release a fix
2005-02-14, 06:25 UTC: Responded that investigation is under-way.
Does not disclose, discuss or confirm issues until a full
investigation has been completed and patches are available.
2005-03-16, 22:04 UTC: Reported that the issue would be fixed in a
future security update.
2005-03-17: Confirmed that the issue would be fixed in the May
security update (2005-005).
2005-04-15, 00:41 UTC: Reported that the issue is addressed in the
10.3.9 update that was due to be released in two hours.
For Safari, update to 10.3.9 using software update. See
<http://docs.info.apple.com/article.html?artnum=301327> for more
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)
-----END PGP SIGNATURE-----