Red Hat Bugzilla – Bug 445357
CVE-2008-1999 WebKit: address bar spoofing using URLs with spaces
Last modified: 2011-02-05 05:18:07 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-1999 to the following vulnerability:
Apple Safari 3.1.1 allows remote attackers to spoof the address bar by placing many "invisible" characters in the userinfo subcomponent of the authority component of the URL (aka the user field), as demonstrated by %E3%80%80 sequences.
Even though this CVE is worded as affecting Apple Safari, this issue is probably
in WebKit. Test case causes both kazehakase(-webkit) and midori to display
spoofed URL as:
attacker_controlled_prefix<spaces ... spaces>@real_url
Depending on the with of your browser window, you may only see
attacker_controlled_prefix part of the URL, which may trick you to believe you
are currently visiting different site.
If you switch kazehakase to use gecko, it will:
- warn you that you are trying to log to a site that does not require
- display %-encoded sequence in address bar
(same behavior as you get with e.g. firefox)
I haven't checked WebKit SVN whether there is any fix for this already.
Tested with: WebKit-gtk-1.0.0-0.8.svn32416
r32901 seems no good (however would you check it?)
Yes, r32901 / WebKit-1.0.0-0.9.svn32901 still affected.
No change with WebKit-1.0.0-0.10.svn34655
The geocities page with the proof of concept is gone. I can't find any reference that this was fixed, but considering how old this is and that we currently have webkitgtk 1.2.x, I imagine this is fixed, but can't verify. Does someone have a local copy of this PoC? I also can't find anything in the upstream webkit bts so no idea if this has been addressed or not.
There is nothing webkit can do in here. URL handling is handled by the browser layer.