malerisch.net

Details Vendor Site: Maxthon (www.maxthon.com) Date: December, 5 2012 – CVE (TBA) Affected Software: Maxthon 3.4.5.2000 and previous versions Status: Patched Researcher: Roberto Suggi Liverani -  @malerisch PDF version:  Maxthon_multiple_vulnerabilities_advisory.pdf Incorrect Executable File Handling The way local executable files are handled by the Maxthon browser seems related to the fact that external tools such as Calc, Desktop, and others can be launched from the browser itself. This design is insecure as it allows JavaScript to directly invoke an executable. As shown in previous exploits, this design can aid exploitation by chaining different vulnerabilities at the same time, allowing for arbitrary command execution. This vulnerability can be exploited in multiple ways: Scenario 1 1. User visits a page which invokes the window.open() function against an executable file – e.g. file:///C:/windows/system32/cmd.exe 2. User unblocks the pop up bl...

Details Vendor Site: Maxthon (www.maxthon.com) Date: December, 5 2012 – CVE (TBA) Affected Software: Maxthon 3.3.3.1000 and previous versions Status: Patched Researcher: Roberto Suggi Liverani -  @malerisch PDF version:  Maxthon_multiple_vulnerabilities_advisory.pdf Cross Context Scripting Cross Context Scripting   (XCS) is a particular code injection attack vector where the injection occurs from an untrusted zone (e.g. Internet) into a privileged browser zone. In this case, it is possible to inject arbitrary JavaScript/HTML code from an untrusted page into Maxthon browser privileged zone - mx://res/*. Description It is possible to inject JavaScript/HTML payload via the “title” parameter of the “Add to Favorites” form. In Maxthon, bookmark UI security controls are weak and allow a trivial exploitation, even for an attentive user, considering the following factors: window.external.addFavorite() can be invoked in an automated fashion; The tit...

Details Vendor Site: Maxthon (www.maxthon.com) Date: December, 6 2012 – CVE (TBA) Affected Software: Maxthon 3.4.5.2000 and previous versions Status: Patched Researcher: Roberto Suggi Liverani -  @malerisch Privileged APIs Available on i.maxthon.com The web site i.maxthon.com can access and use privileged Maxthon DOM object (e.g. maxthon.*). Such Maxthon object interfaces can be used to read last visited pages or favorites, as shown in the following screen shot. Such information can only be retrieved by using privileged Maxthon functions. Different issues were identified regarding this design: No control on resolution of IP address for i.maxthon.com domain; No use of SSL to serve the i.maxthon.com web site; Use of icon "Trusted site" on the URL bar even when i.maxthon.com resolves to a different IP address. Exploitation This vulnerability can be exploited in several ways, as listed below: DNS poisoning - Force resolution of i.maxthon.com...

Details Vendor Site: Maxthon (www.maxthon.com) Date: December, 5 2012 – CVE (TBA) Affected Software: Maxthon 3.4.5.2000 and previous versions Status: Unpatched (at the time of publishing) Researcher: Roberto Suggi Liverani -  @malerisch PDF version: Maxthon_multiple_vulnerabilities_advisory.pdf Cross Context Scripting Cross Context Scripting   (XCS) is a particular code injection attack vector where the injection occurs from an untrusted zone (e.g. Internet) into a privileged browser zone. In this case, it is possible to inject arbitrary JavaScript/HTML code from an untrusted page into Maxthon browser privileged zone - mx://res/*. Description A malicious user can inject arbitrary JavaScript/HTML code via multiple RSS feed elements. Vulnerable elements are the following: <title> element: JavaScript injection using HTML encoded payload <link> element: JavaScript injection using javascript: pseudouri <description> element:...

Details Vendor Site: Maxthon (www.maxthon.com) Date: December, 5 2012 – CVE (TBA) Affected Software: Maxthon 3.4.5.2000 and previous versions Status: Unpatched (at the time of publishing) Researcher: Roberto Suggi Liverani - @malerisch PDF version:  Maxthon_multiple_vulnerabilities_advisory.pdf Cross Context Scripting Cross Context Scripting  (XCS) is a particular code injection attack vector where the injection occurs from an untrusted zone (e.g. Internet) into a privileged browser zone. In this case, it is possible to inject arbitrary JavaScript/HTML code from an untrusted page into Maxthon browser privileged zone - mx://res/*. Description A malicious user can inject arbitrary JavaScript/HTML code through the websites visited with the Maxthon browser. The code injection is rendered into the History page (about:history), which displays URL and a short description of the visited pages. A malicious user can inject JavaScript/HTML content by using the l...