[Full-disclosure] Firefox focus stealing vulnerability (possiblyother browsers) 's

鬼仔：我用的是 firefox 2.0 ，测试成功。

看了下源文件，只要你输入的文字里面的字符里面包含了C:/boot.ini之后就会触发（不需要连在一起，分散的就可以），
C:/boot.ini对应的一个数组 var needstr = [ 67, 59, 220, 66, 79, 79, 84, 190, 73, 78, 73 ];
这个是指定读取C:/boot.ini
你可以通过改下这个读取其他文件。

来源：幻影的邮件列表

There is an interesting logic flaw in Mozilla Firefox web browser.

The vulnerability allows the attacker to silently redirect focus of selected key press events to an otherwise protected file upload form field. This is possible because of how onKeyDown / onKeyPress events are handled, allowing the focus to be moved between the two. If exploited, this enables the attacker to read arbitrary files on victim's system.

This was tested with 2.0.0.1. Opera is most likely not vulnerable; Microsoft Internet Explorer is not vulnerable as-is, but might be vulnerable to a variant of the attack.

All INPUT TYPE=FILE form fields enjoy the benefits of added protection to prvent scripts from arbitrarily choosing local files to be uploaded to the server, and automatically submitting the form. For example, .value parameter cannot be set or changed, and any changes to .type reset the contents of the field.

Unfortunately, Firefox allows a malicious script to redirect carefully selected, individual user keystrokes to a hidden file upload field, in order to compose a particular filename, then submit the form. User interaction is required, limiting the impact somewhat – but any website where the user can be reasonably expected to enter some text (a keyboard-controlled web game, a blog posting or commenting interface) can attempt to exploit the vulnerability, and eventually succeed with one user or another.

A quick and naive demonstration of the problem (Firefox on Windows is required; depends on scancode values, so not all keyboards may be

supported):

http://lcamtuf.coredump.cx/focusbug/

(Ta-dah again)

/mz