Mozilla Firefox 1.0.1 Javascript Images are Draggable

From: Paul (paul_at_greyhats.cjb.net)
Date: 02/26/05

  • Next message: Stan Bubrouski: "Re: Firescrolling [Firefox 1.0]" 
    Date: 26 Feb 2005 05:12:47 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    Author: Paul
    Affected Software: Mozilla Firefox 1.0.0, 1.0.1 (tested only on these versions)
    Risk: Low/Medium

    A minor security vulnerability exists in the way that Firefox handles cross-domain image dragging. Dragging an image into the address bar will cause Firefox to navigate to the image url even if it is a javascript url and the page to be navigated from is in a different domain than the page on which the image is shown. This may potentially allow attackers to steal cookies, etc.

    A proof of concept is available at
    http://greyhatsecurity.org/vulntests/firefox.htm

    Vendor Reccomendations:
    Disable dragging images with javascript urls.

    User Reccomendations:
    Do not drag images into the address bar.

    Paul
    http://greyhatsecurity.org

  • Next message: Stan Bubrouski: "Re: Firescrolling [Firefox 1.0]"