Details Vendor Site: Maxthon (www.maxthon.com) Date: December, 6 2012 – CVE (TBA) Affected Software: Maxthon 3.4.5.2000 and previous versions Status: Patched Researcher: Roberto Suggi Liverani - @malerisch Privileged APIs Available on i.maxthon.com The web site i.maxthon.com can access and use privileged Maxthon DOM object (e.g. maxthon.*). Such Maxthon object interfaces can be used to read last visited pages or favorites, as shown in the following screen shot. Such information can only be retrieved by using privileged Maxthon functions. Different issues were identified regarding this design: No control on resolution of IP address for i.maxthon.com domain; No use of SSL to serve the i.maxthon.com web site; Use of icon "Trusted site" on the URL bar even when i.maxthon.com resolves to a different IP address. Exploitation This vulnerability can be exploited in several ways, as listed below: DNS poisoning - Force resolution of i.maxthon.com...
Security research, divulgations and food for thought.