Date: Sun, 6 Jun 1999 13:15:08 +0300 From: Georgi Guninski To: BUGTRAQ@netspace.org Subject: Netscape Communicator code injection in JavaScript console using "view-source:" protocol There is a bug in Netscape Communicator 4.6 Win95, 4.07 Linux (probably all 4.x are affected), which allows sniffing URLs from another window. The problem is the injection of JavaScript code in the JavaScript console using the "view-source:" protocol. Access to document.links is disallowed in NC 4.6, but the document may be read using find(). For more information, examine the source. Workaround: Disable Javascript. Demonstration is available at: http://www.nat.bg/~joro/viewtrack.html Regards, Georgi Guninski http://www.nat.bg/~joro http://www.whitehats.com/guninski ---------------------------------------------------------------------- Control Window There is a bug in Netscape Communicator 4.6 Win95, 4.07 Linux (probably others?), which allows sniffing URLs from another window.
The problem is the injection of JavaScript code in the JavaScript console using "view-source:".
Access to document.links is disallowed in NC 4.6, but the document may be read using find().
Type your URL in the "Tracked window" and then click "Show URL" in this window.
Workaround: Disable Javascript.
Show URL
Written by Georgi Guninski