il marche comme sa :
Firelinking - Proof-of-Concept
Designed for Firefox 1.0.2 | bugzilla #290036
NOTICE: I really wonder why the Mozilla Foundation decided to release a serious security update on a friday night and to disclose the link to my proof-of-concept code so quickly. It wasn´t intendet from my side to release this as a 0day exploit. Please complain to security@mozilla.org if you disagree with their release policy. Sorry, no CVE candidate number yet for that reason.
The link tag allows to load a custom image as the icon for a website, displayed in the location bar and in the tab title.
By setting the href attribute of this tag to a javascript url, it is possible to call chrome functions and run arbitrary code without user interaction.
The example is cross platform: On Windows this example creates the file c:\booom.bat and launches it ( opens a dos box with a dir command). On Linux ( tested Fedora Core) and MacOSX the example creates the file ~/booom.txt or / booom.txt.
The non-windows examples are only roughly tested. Please don´t complain if not working. I doubt every Mac user can write to root by default. You get full user rights with UniversalXPConnect, so everything else is just a matter of implementation time.
Run example ( cross platform)
