###########################################
Orca Browser browser:home Persistent XSS vulnerability
vendor url: http://www.orcabrowser.com/
Advisore: http://lostmon.blogspot.com/2009/07/
orca-browser-browserhome-persistent-xss.html
vendor notify: NO exploit available: yes
############################################
#############
description
#############
Orca Browser´s user-friendly interface brings a new level
of clarity and efficiency to your browsing experience,and
frequent upgrades have steadily improved its reliability.
Avant Browser is freeware That's right. 100% Free!.
Orca Browser contains a flaw that allows a remote cross site
scripting attack.This flaw exists because the application does
not validate properly the url links upon submission to the
bookmarks in browser:home page.
This could allow a user to create a specially crafted URL or a
bookmark that would execute arbitrary code in a user's browser
within the trust relationship between the browser and the server
wen try to load browser:home ,leading to a loss of integrity.
###############
version tested
###############
Avant Browser 1.2 build 2
#########
solution:
##########
Update to version 1.2. build 3
this version address this vulnerability.
#############
timeline:
#############
discovered: 23-jul-2009
disclosure: 30 jul 2009
##################
testing
##################
Demostration Video => http://www.spymac.com/details/?2417793
Open Orca Browser and by default the browser load
'browser:home' page. in this page we can view tree
columns , 1 top sites 2 history and 3 recent bookmarks.
Bookmarks column is vulnerable to a xss. let´s go
to demostrate.
I make a web page posible vulnerable to a xss condition
<?
$cmd=$_GET[id]
?>
I place a online doc for demo here =>
http://usuarios.lycos.es/reyfuss/id.php?id=
open Orca browser and navigate to
http://usuarios.lycos.es/reyfuss/id.php?id="><script>alert(1)</script>
click in bookmark Tool bar and click in new bookmark and add this url.
Load browser:home or close and open the browser , the script
is executed in bookmarks column.
################ End #####################
thnx to estrella to be my ligth
thnx to Brink he is investigate with me.
thnx to all who day after day support me !!!
atentamente:
--
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente...