IE Local Open Hack
Here I present a useless vulnerability that I found while drinking my coffee one Saturday morning. It seams that Internet Explorer can be forced to open file:// resources from http:// URLs. Weirdly, this exploit works only from localhost so in theory it does not posses any risk at all. However, I am not sure if this condition is met because I am doing something wrong.
If you have time investigating the matter, please report your findings. I personally don’t have much time digging into this issue. However, if someone makes this POC work from every http:// then obviously that will be quite concerning.
When unaware user clicks on a link build as shown in the provided POC, a confirmation box opens. Although it is obvious what is going on if you are familiar with these types of exploits, it might not be the case with normal users. The impact level of this issue is close to zero. Why did I waste my time reporting this? Well, I spend 20 minutes finding the issue, which is not that much. Moreover, this issue could become quite nasty.
Comments
Local resources cannot be accessed from by default the “Internet Zone”.
localhost is considered “Intranet Zone”, which by default allows referencing local resources.
These settings, of course, can be changed in the “Internet Options”.
Aviv, yes u r right but still if you make a page that contains something like this:
and you host it on localhost, and then you try to click on the link, it simply wont result in what you may expect. well, at least it doesn’t work for me. This means that, although the security is relaxed on localhost, it is not to the extend we think it is.
Or maybe, the coffee didn’t help much :) this morning.
cheers
Man. This exploit works on your IE7, but doesn’t work on my IE6 Win XP SP2. As well as it doesn’t work at not IE browsers. Maybe it is some IE7 feature.
So, Pdp, you need more coffee :-)
This exploit works very good en ie/mozilla , on win xp sp2.