I've found a bug with cycled asynchronous XMLHttp in different browsers. If you create html page with following code
<html>
<head>
<script>
function getXmlHttp(){
var xmlhttp;
try {
xmlhttp = new ActiveXObject("Msxml2.XMLHTTP");
} catch (e) {
try {
xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
} catch (E) {
xmlhttp = false;
}
}
if (!xmlhttp && typeof XMLHttpRequest!='undefined') {
xmlhttp = new XMLHttpRequest();
}
return xmlhttp;
}
</script>
<script>
function getXmlHttpHACK(){
var xmlhttp = getXmlHttp()
xmlhttp.open('GET', 'drupal', false);
xmlhttp.send(null);
if(xmlhttp.status == 404) {
getXmlHttpHACK();
}
}
</script>
<script>
var xmlhttp = getXmlHttp()
xmlhttp.open('GET', 'drupal', true);
xmlhttp.onreadystatechange = function() {
if (xmlhttp.readyState == 4) {
if(xmlhttp.status == 404) {
getXmlHttpHACK();
}
}
};
xmlhttp.send(null);
</script>
</head>
</html>
and open it, you will see how different browsers begin to devour system resources.
- Internet Explorer 7/8 shows a message "Stack overflow at line:23" and stop page loading
- Firefox 3.5 and Chrome handles this correctly
- Opera 10 crashes
- Apple Safari hangs
I'm not strong in browsers vulnerabilities so I want to know if this is a simple crash bug or it's Buffer Overflow which allows to run shell code
Edited 1 time(s). Last edit at 07/29/2009 03:43AM by p0dge.