Possible new cross zone scripting in IE

From: Cheng Peng Su (apple_soup_at_msn.com)
Date: 02/10/04

  • Next message: N|ghtHawk: "Re: HelpCtr - allow open any page or run" 
    Date: 10 Feb 2004 14:31:35 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    title:Possible new cross zone scripting in IE
    program:MS Internet Explorer
    test on:IE 6.0(sp1),winXP/ME

    Proof of Concept:
          From res://C:\WINDOWS\SYSTEM\BROWSELC.DLL/mbOffline.htm
    ,i found
    <a href="shell:My Music" onmouseover="window.status=L_MyMusic_Text;return true" onmouseout="window.status='';return true">
    this links to a folder(c:\My document\My Music).

    I built a page(http://www.freewebs.com/applesoup/shell_my_music.htm) like following:
      <iframe src="shell:my music"/>
    this frame is in "My computer" zone.
    I think there is some way to make cross zone scripting to this frame.

    -------------
    Cheng Peng Su

  • Next message: N|ghtHawk: "Re: HelpCtr - allow open any page or run"
    • Quantcast