Back to list
Babylon Cross-Application Scripting Code Execution
Nov 10 2010 04:41PM
Roee Hay (ROEEH il ibm com)
Babylon is a single-click computer online dictionary and translation
which is also capable of translating whole documents and web pages. The
translation and dictionary results are presented to the user via the
layout engine (an in-app/embedded Internet-Explorer rendering engine).
Babylon fails to sanitize user input before rendering it on the Trident
effectively leading to a Cross-Application Scripting vulnerability.
The user's input can originate from the following sources:
1. Babylon's main translation interface: When searching for a non-existent
term Babylon pushes the string "No matches were found for 'non-existent
term'. Search the web for non-existent-term". Unfortunately,
term' is not HTML encoded or validated before it is written on the
browser (the translation process transparently validates translatable
2. Document translation: Documents (such as PDF files) may contain text
without HTML encoding or validation.
3. Web site translation: Same as the document translation case. Text which
not translated is simply rendered on the Trident control. In order to
an attack, the victim has to be lured into translating malicious text,
in a document or on a web page. Although the scenarios require some
social-engineering, some of them are feasible and realistic.
The Trident control runs in Local Machine Zone (LMZ) which is not Locked
This allows a malicious script to perform the following actions:
1. Interact with other websites in the background while using persistent
to impersonate the victim: This can be done using XHR. The payload can
the response's body which may contain sensitive information in case the
victim has been authenticated on the site prior to the attack. The
can also perform actions on the site on behalf of the victim.
2. Collect information from local files: This can be done using XHR or by a
hidden iframe with the filename's as the source. Since the payload runs
non-Locked-down LMZ, the XHR response or iframe's body can be inspected
sent back to the attacker.
3. Code execution: System commands can be executed by using the
ActiveX object to practically take over the whole system.
Versions prior to 8.0.7 are susceptible to this vulnerability.
Yair Amit <amityair (at) il.ibm (dot) com [email concealed]>
Roee Hay <roeeh (at) il.ibm (dot) com [email concealed]>
We would like to thank the Babylon team for their quick responses and the
efficient way in which they handled this security issue.
1. Original advisory:
2. Blog post:
4. Babylon's homepage:
5. Enhanced Browsing Security:
[ reply ]
Copyright 2010, SecurityFocus