Mozilla Firefox 1.0.1 Javascript Images are Draggable

[Paul]

Author: Paul
Affected Software: Mozilla Firefox 1.0.0, 1.0.1 (tested only on these versions)
Risk: Low/Medium

A minor security vulnerability exists in the way that Firefox handles cross-domain image dragging. Dragging an image into the address bar will cause Firefox to navigate to the image url even if it is a javascript url and the page to be navigated from is i
n a different domain than the page on which the image is shown. This may potentially allow attackers to steal cookies, etc.

A proof of concept is available at
http://greyhatsecurity.org/vulntests/firefox.htm

Vendor Reccomendations:
Disable dragging images with javascript urls.

User Reccomendations:
Do not drag images into the address bar.

Paul
http://greyhatsecurity.org

[Jay D. Dyson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Fri, 26 Feb 2005, Paul wrote:

> A minor security vulnerability exists in the way that Firefox handles
> cross-domain image dragging. Dragging an image into the address bar will
> cause Firefox to navigate to the image url even if it is a javascript
> url and the page to be navigated from is in a different domain than the
> page on which the image is shown. This may potentially allow attackers
> to steal cookies, etc.

Just one question: what could possibly compel someone to drag a
broken image into their browser's location bar? I'm not trying to be a
wiseguy. I'm honestly puzzled as to why anyone would take an obviously
broken image and drag it into the browser location bar.

Side note: the behavior you describe is the same if one
right-clicks Javascript "image" and selects "View Image" from the pop-up
dialog.

> User Reccomendations:
> Do not drag images into the address bar.

...or hyperlinks. Those too can be obfuscated via Javascript, and
they can also be dragged into the location bar.

- -Jay

( ( _______
)) )) .-"There's always time for a good cup of coffee"-. >====<--.
C|~~|C|~~| (>----- Jay D. Dyson -- jdyson@treachery.net -----<) | = |-'
`--' `--' `-I just started World War III. You're welcome.-' `------'

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (TreacherOS)
Comment: See http://www.treachery.net/~jdyson/ for current keys.

iD8DBQFCILecBYoRACwSF0cRApf9AKCvKMjf9qrVp/JYHeoL0W4an/a0UgCfXD/q
UVjg8Q/gb6If85CD7SRgEqU=
=Tsr9
-----END PGP SIGNATURE-----