Konqueror DoS Via JavaScript Read Of FTP Iframe

Author: mark@bindshell.net
Published: 4th March 2007

Summary

Konqueror crashes if JavaScript code tries to read the source of a child iframe which is set to an FTP URL.

Impact

It is possible for malicious websites to crash Konqueror and possibly other applications with rely on KJS.

Details

The KDE JavaScript implementation, KJS has been found to crash when it tries to read the contents of an FTP iframe. This can be demonstrated by creating a web page with an iframe with a src of "ftp://localhost/anything", then reading the contents of this iframe with JavaScript similar to the following. (A working FTP server is not required).

document.getElementById(iframe_name).contentWindow.document.body.innerHTML;

Exploit

Proof of concept code is available at:
http://bindshell.net/advisories/konq355/konq355-crash-demo.zip

Vulnerable Versions

This vulnerability has been tested on Gentoo and Debian running KDE 3.5.5.

Disclosure Timeline

2007-02-03 Vulnerability reported to security@kde.org
2007-02-28 KDE team recreate bug and produce preliminary patch for nodes.cpp
2007-03-01 KDE team produced updated patch for ecma/kjs_html.cpp
2007-03-04 Public advisory released

Patch Information

The latest patch received from the KDE team is available from:
http://bindshell.net/advisories/konq355/konq355-patch.diff

Vulnerability IDs

Bugtraq ID 22814
CVE CVE-2007-1308
Xforce ID 32798
Milw0rm 3415