######################################## GreenBrowser About: dialog XSS and stored XSS Vendor URL:http://www.morequick.com/ advisore:http://lostmon.blogspot.com/2012/03/greenbrowser-about-dialog-xss-and.html Vendor notify:NO exploit available:yes ####################################### GreenBrowser is your best choice of flexible and powerful green web browser. GreenBrowser is free to download and use. GreenBrowser contains a two flaws that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the about: Uri dialog and last visited pages. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. Also the browser save the last URL visited and then, if a user create a crafted link and clin in, it is a stored XSS because when open the browser by default it open http://www.5igb.com/StartEn.htm and it have the last visited URL... The xss is executed in this URL :) page and browser not validate LastVisitWriteEn() before render to the user. You can see this function here => http://www.5igb.com/function.js ################# Proof of Concept ################# create a html doc and write this code, click in the link and it execute the xss close the browser and open it again, in last visit pages we have the url of PoC and it executes the stored XSS GreenBrowser about: handler XSS ################ Versions afected ################ 6.1.0117 (2012-01-17 10:22:02) 6.1.0216 (2012-02-16 21:37:10) ################## Solution ################### No solution was available at this time !!! ################ €nd #################### -- atentamente: Lostmon (lostmon@gmail.com) Web-Blog: http://lostmon.blogspot.com/ Google group: http://groups.google.com/group/lostmon (new) -- La curiosidad es lo que hace mover la mente....