Medium severity flaw in Konqueror

2011.04.20
Credit: Tim Brown
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

I was recently taking a look at Konquerer and spotted an example of universal XSS. Essentially, the error page displayed when a requested URL is not available includes said URL. If said URL includes HTML fragments these will be rendered. CVE-2010-2952 has been assigned to this issue. Tim -- Tim Brown <mailto:timb (at) nth-dimension.org (dot) uk [email concealed]> <http://www.nth-dimension.org.uk/> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Nth Dimension Security Advisory (NDSA20110321) Date: 21st March 2011 Author: Tim Brown <mailto:timb (at) nth-dimension.org (dot) uk [email concealed]> URL: <http://www.nth-dimension.org.uk/> / <http://www.machine.org.uk/> Product: Konqueror 4.4.x, 4.5.x, 4.6.x <http://konqueror.kde.org/> Vendor: KDE <http://www.kde.org/> Risk: Medium Summary The Konqueror web browser is vulnerable to HTML injection into the error pages that are displayed when it fails to fetch the requested URL. This could allow an arbitrary web site to be spoofed. After discussions with the vendor, CVE-2011-1168 was assigned to this vulnerability. Technical Details Konqueror 4.4.x, 4.5.x and 4.6.x are affected by HTML injection which allows an arbitrary URL to be spoofed. Opening a fresh instance of Konqueror and entering the following URL causes the error page HTML to become corrupted: http://thisdomainwillnotresolveandrekonqerrorpagewillbeshownwithfullurle mbedded.twitter.com/"><h1>Test</h1> Since Konqueror fails to resolve the hostname it will then will display an error message containing the requested URL including the HTML tags. It is worth noting that Javascript execution does not appear to be possible in the context of the unresolvable hostname for two reasons. Firstly Konqueror disables Javascript within KHTMLPart::htmlError() (between the calls to begin() and end() and secondly because the code executes in an empty domain preventing the cookies for the spoofed URL from being accessed. Whilst the first of these restrictions could be bypassed in a number of ways (see below), no method has currently been identified to bypass the latter to break Konqueror's same origin policy. It was identified that the first restriction could be bypassed at least two ways. Firstly a link can be injected with a URL in the form javascript:... and secondly an iframe can be injected with a source URL in the form data:text/html,... In the first case, Konqueror only interprets the link at the point of clicking (after Javascript has been reenabled) whilst in the latter, Konqueror does not disable Javascript during the parsing of the source for this iframe (i.e. between the calls to begin() and end()). The following URL demonstrates how HTML can be injected which both takes control of the entire visible DOM by overriding the error page styles for an arbitrary "secure" URL and then allows Javascript to be executed in the victims browser: https://secure.twitter.com/</title></head><body><style>body{margin: 10px 0; background:#C0DEED url(http://si0.twimg.com/sticky/error_pages/bg-clouds.png) repeat-x; color:%23333; font: 12px Lucida Grande, Arial, sans-serif; text-align:center};%23box {display: none}</style></div><br/><br/><br/><br/><br/><br/><br/><br/><br/><iframe width=25%25 height=180 frameBorder=0 src='data:text/html,<body style="background-color:transparent"><img src=http://si0.twimg.com/sticky/error_pages/twitter_logo_header.png><a>< form><p>Username: <input type=text></p><p>Password: <input type=password></p><input type=submit value=Login></form><script>alert(1)</script></body>'><div id="box"> Solutions Nth Dimension recommends that the vendor supplied patches should be applied. History On 16th March 2011, Nth Dimension contacted the KDE security team to report the described vulnerability. On 17th March 2011, Harri Porten of KDE confirmed that he had recieved the report and it had been escalated to Maksim Orlovich, a KDE developer working on KHTML to determine the impact. Nth Dimension worked with the Maksim to evaluate the full extent of the problem, particulary in relation to the bypass of the Javascript restriction as any same origin policy implications and an interim patch was produced. On 18th March 2011, Nth Dimension contacted Josh Bressers on behalf of the KDE security team to request a CVE for this vulnerability which was duely assigned. Following the assigment of a CVE for this issue, Nth Dimension and KDE liased to establish a date for final publication of the advisory and patches. Current As of the 23rd March 2011, the state of the vulnerabilities is believed to be as follows. A patch has been developed which it is believed successfully mitigates the final symptoms of this vulnerability. This patch has been ported to 4.4.x, 4.5.x and 4.6.x branches of KDE and will be made available to distributions in due course. Thanks Nth Dimension would like to thank Maksim Orlovich and Jeff Mitchell of KDE and Josh Bressers of Redhat for the way they worked to resolve the issue.

References:

https://bugzilla.redhat.com/show_bug.cgi?id=695398
http://xforce.iss.net/xforce/xfdb/66697
http://www.vupen.com/english/advisories/2011/0927
http://www.securityfocus.com/bid/47304
http://www.securityfocus.com/archive/1/archive/1/517433/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/517432/100/0/threaded
http://www.nth-dimension.org.uk/pub/NDSA20110321.txt.asc
http://www.kde.org/info/security/advisory-20110411-1.txt
http://securitytracker.com/id?1025322
http://secunia.com/advisories/44065


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top