module

Internet Explorer Iframe Sandbox File Name Disclosure Vulnerability

Try Surface Command
Back to search
Disclosed
Aug 9, 2016
Created
May 30, 2018

Description

It was found that Internet Explorer allows the disclosure of local file names.
This issue exists due to the fact that Internet Explorer behaves different for
file:// URLs pointing to existing and non-existent files. When used in
combination with HTML5 sandbox iframes it is possible to use this behavior to
find out if a local file exists. This technique only works on Internet Explorer
10 & 11 since these support the HTML5 sandbox. Also it is not possible to do
this from a regular website as file:// URLs are blocked all together. The attack
must be performed locally (works with Internet zone Mark of the Web) or from a
share.

Author

Yorick Koster

Platform

Windows

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use auxiliary/gather/ie_sandbox_findfiles
    msf auxiliary(ie_sandbox_findfiles) > show actions
        ...actions...
    msf auxiliary(ie_sandbox_findfiles) > set ACTION < action-name >
    msf auxiliary(ie_sandbox_findfiles) > show options
        ...show and set options...
    msf auxiliary(ie_sandbox_findfiles) > run
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today