Description
Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability."
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 3
- Opera Browser 6.0 6 - URI Display Obfuscation EDB-23465 · remote · Dec 23, 2003 · verified
- Microsoft Internet Explorer 5/6 / Mozilla 1.2.1 - URI Display Obfuscation (1) EDB-23422 · remote · Dec 9, 2003 · verified
- Microsoft Internet Explorer 5/6 / Mozilla 1.2.1 - URI Display Obfuscation (2) EDB-23423 · remote · Dec 9, 2003 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- oval:org.mitre.oval:def:510 vdb-entry signature
- oval:org.mitre.oval:def:526 vdb-entry signature
- VU#652278 third-party-advisory
- 20031209 Internet Explorer URL parsing vulnerability mailing-list
- oval:org.mitre.oval:def:513 vdb-entry signature
- ie-domain-url-spoofing(13935) vdb-entry
- oval:org.mitre.oval:def:491 vdb-entry signature
- TA04-033A third-party-advisory
- oval:org.mitre.oval:def:512 vdb-entry signature
- oval:org.mitre.oval:def:490 vdb-entry signature
- MS04-004 vendor-advisory
- http://www.zapthedingbat.com/security/ex01/vun1.htm
- oval:org.mitre.oval:def:511 vdb-entry signature