Unauthorized Access to Local Resources in Microsoft Internet Explorer

vendor:

Internet Explorer

by:

Liu Die Yu

7.5

CVSS

HIGH

Unauthorized Access

264

CWE

Product Name: Internet Explorer

Affected Version From: Internet Explorer 6

Affected Version To: Internet Explorer 6 SP1

Patch Exists: YES

Related CWE:

CPE: a:microsoft:internet_explorer:6

Metasploit:

Other Scripts:

Platforms Tested: Windows

2003

Unauthorized Access to Local Resources in Microsoft Internet Explorer

The issue allows unauthorized access to local resources in Microsoft Internet Explorer. By adding an additional slash when specifying a resource via the file:// or res:// protocols, the restrictions imposed by Internet Explorer version 6 SP1 can be bypassed. This can potentially aid in the exploitation of other vulnerabilities, allowing an attacker to create files on a client system and reference them using these protocols. The exact cause of the issue is currently under investigation.

Mitigation:

Apply the latest security patches and updates provided by Microsoft. Avoid visiting untrusted websites and exercise caution when clicking on links or downloading files.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/8886/info

Microsoft Internet Explorer is prone to an issue that may allow for unauthorized access to local resources. Internet Explorer version 6 SP1 imposed restrictions to limit remote sites from accessing local resources via file:// or res:// URIs (or other variants). It is reported that these restrictions may be bypassed by adding an additional slash when specifying a resource via one of these protocols.

This could aid in exploitation of other vulnerabilities, such as issues that permit an attacker to create files on a client system in a predictable location. Such content could then be referenced by an attacker using these protocols. The initial vulnerability report stated that the issue allowed for Zone Restriction Bypass via malformed IFRAMES. Additional technical information has been provided that contradicts the initial analysis. BID 8900 was created to describe the separate issue in Macromedia Flash.

Liu Die Yu has released conflicting information that states that this issue occurs because the user is redirected into a local resource and then the local resource is being refreshed. It is reported that other variations such as "file://" or "[DriveLetter]:\[...]" also work with this exploit. This is currently under investigation. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21199.zip