Re:Zero-click, wormable, cross-platform remote code executio...
by tinus_hn on Wednesday December 09, 2020 @06:21AM
(#25357492)
If that event appears as user interaction you might be able to make a minor vulnerability out of it, instance to create pop-ups without interaction.
Re:Zero-click, wormable, cross-platform remote code executio...
by bjarneh on Wednesday December 09, 2020 @06:59AM
(#25357705)
Yes that should be possible. Unfortunately I was in the opposite position, i.e. I had to make this browser look normal by hiding all of its misbehaviors, not try to exploit them :-)
Re:Zero-click, wormable, cross-platform remote code executio...
by tinus_hn on Wednesday December 09, 2020 @09:10AM
(#25358588)
Yes but if you can find a way to exploit it you can file it as a security issue and get Microsoft to fix it or even pay you!
Re:Zero-click, wormable, cross-platform remote code executio...
by bjarneh on Thursday December 10, 2020 @07:39AM
(#25373046)
Ah, that's the loophole in Microsoft's bug-reporting. It's not just hard to file bug-reports, you have to find ways to exploit every bug in a way that make them security issues :-)
> and get Microsoft to fix it or even pay you!
That would be nice...
Re:Zero-click, wormable, cross-platform remote code executio...
by qz2 on Tuesday December 08, 2020 @02:32PM
(#25350186)
I feel for you. At least it’s good to know that IE11 is likely to die before we do at the moment :)
Re:Zero-click, wormable, cross-platform remote code executio...
by bjarneh on Wednesday December 09, 2020 @06:56AM
(#25357681)
The sad news was that this browser was the recommended browser to use inside the company as it worked best with "Sharepoint".
Basically a total hack was required for every AJAX request that could return input fields with non-ASCII characters, as the page itself listened for input events on these elements. I.e. we basically have to wait for the AJAX-elements to be added to the DOM (removing any 'input' listener as they are), then add the same event-listeners again after every AJAX-call etc, not exactly an elegant solution...
http://bjarneh.github.io/ie/index.html
Strange bug where input fields added to the DOM containing non-ASCII characters (whether you escape them or not) trigger 'input' events. So the example page loaded in IE will already have triggered 2 'input' events, since the last 2 input-elements contain the letter 'å' (escaping it as å makes no difference).
After getting through the trouble of submitting the bug, nothing happened. About 6 months later I got an email saying the ticket was closed; as they were not able to reproduce the bug. The bug is still here today 5 years later.