Apple Safari Web Browser 1.x - HTML Form Status Bar Misrepresentation

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1054814 漏洞类型
发布时间 2004-12-15 更新时间 2004-12-15
漏洞平台 OSX CVSS评分 N/A

A vulnerability has been identified in Apple Safari Web Browser that allows an attacker to misrepresent the status bar in the browser, allowing vulnerable users to be mislead into following a link to a malicious site.

The issue presents itself when an attacker creates an HTML form with the submit 'value' property set to a legitimate site and the 'action' property set to the attacker-specified site. The malicious form could also be embedded in a link using the HTML Anchor tag and specifying the legitimate site as the 'href' property. As a result, the attacker-supplied link would point to the legitimate site and the status bar would display the address of the legitimate site as well.

<form action="" method="get">
<a href=""><input type="image" src=""></a>