Multiple Vendor Web Browser JavaScript Key Filtering Vulnerability

Affects: IE, Firefox, etc

Multiple Vendor Web Browser JavaScript Key Filtering Vulnerability

"Multiple web browser products are susceptible to a JavaScript key-filtering
vulnerability. This issue is due to the failure of the browsers to securely
handle keystroke input from users.

This issue is demonstrated to allow attackers to divert keystrokes from one
input form in a webpage to a hidden file upload dialog in the same page.
This may allow remote attackers to initiate file uploads from unsuspecting
users. Other attacks may also be possible.

Exploiting this issue requires that users manually type the full path of
files that attackers wish to download. This may require substantial typing
from targeted users, so keyboard-based games, blogs, or other similar pages
are likely to be utilized by attackers to entice users to enter the
required keyboard input to exploit this issue.

Mozilla Suite, Mozilla Firefox, Mozilla SeaMonkey, Netscape Navigator, and
Microsoft Internet Explorer are all reportedly vulnerable to this issue."


http://www.securityfocus.com/bid/18308/discuss


-- Imhotep